CVE-2026-11894

This CVE reveals a failure mode that should concern anyone writing C code against RTOS driver APIs: the buffer-ownership contract was documented correctly but enforced nowhere, and the standard C cleanup pattern created exactly the vulnerability the contract was designed to prevent. The bt_hci_driver_api specifies that drivers consume the buffer on success and return it untouched on error. This is a conditional ownership model that most C programmers never encounter—functions typically own their resources regardless of exit path. The developer implemented a common pattern: a shared cleanup label that unreferences the buffer before returning. That pattern works when ownership is unconditional, but here it produced a double-free on the error path combined with a use-after-free read in the LOG_ERR statement that executed after the buffer was already released. The compounding failure is telling. The moment the developer focused on diagnosing failure—the LOG_ERR path—was precisely when the ownership rule was forgotten. This isn't carelessness; it's a cognitive trap that the development environment provides no guardrail against. The cleanup-goto pattern has a documented history of producing this exact failure mode across decades of C programming, from Windows kernel drivers to Linux staging drivers to embedded RTOS subsystems. The trigger condition matters: a remote Bluetooth peer can induce controller resource exhaustion, forcing the error path that triggers the double-free. The corrupted buffer is drawn from a shared net_buf pool—pool corruption becomes systemic rather than isolated to the HCI driver. The structural fix isn't adding another code review pass. The ecosystem needs compile-time ownership annotations or static analysis that treats these API contracts as enforceable constraints rather than prose guidance. Until then, every driver written against this API carries the same precondition—and the next developer will face the same cognitive trap at the exact moment they're least equipped to avoid it.

Reviewed through automated stages and approved by a human before publication.