1. The bt_conn_tx_processor deallocating net_bufs that are holding ACL TX data to be sent when an LE Bluetooth disconnection has taken place.
2. It uses the l2cap_pull_data function which is responsible for preparing the data to send while returning a net_buf pointer.
3. the l2cap_pull_data is also responsible for popping the PDU from the channel tx_queue when the last segment (K-frame) has been sent.
4. The bt_conn_tx_processor does not take into account that l2cap_pull_data is segmenting the data and assumes that returned pointer can be “UNREFED” (freed).
   a. only when conn->state is not CONNECTED.
5. Leading to a write-before-zero when the next segment send is acknowledged.
6. This 4 bytes that are written are highly controlled by outside attacker and this can form the basis of a reliable exploit.

Impact

• Causes a use-after-free, resulting in a write-before-zero (stale buffer is reused and written to).
• The written 4 bytes are attacker-controlled, enabling precise memory corruption.
• This can form the basis of a reliable remote exploit

Patches

main: #90975

For more information

If you have any questions or comments about this advisory:

• Open an issue in zephyr
• Email us at Zephyr-vulnerabilities

embargo: 2025-09-05