{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "extracted_events": [
              {
                "range": [
                  {
                    "introduced": "3.0.0"
                  },
                  {
                    "fixed": "4.3.2"
                  }
                ],
                "source": "AFFECTED_FIELD",
                "strategy": "StandardRange"
              },
              {
                "range": [
                  {
                    "introduced": "4.4.0"
                  },
                  {
                    "fixed": "4.5.0"
                  }
                ],
                "source": "AFFECTED_FIELD",
                "strategy": "StandardRange"
              },
              {
                "range": [
                  {
                    "fixed": "e9c3252c244b094b9caf6f426ffb77c509e58a9f"
                  }
                ],
                "source": "REFERENCES_COMMIT"
              }
            ]
          },
          "events": [
            {
              "introduced": "4f8d78ceeb436e82f528511998515f6fc137c6cd"
            },
            {
              "fixed": "28af05ca658cbacf745fd5b099566311c58ccb1d"
            },
            {
              "introduced": "684c9e8f32e4373a21098559f748f06915f950c9"
            },
            {
              "fixed": "41d10b59730406bbab4ca9f1fbbe9e96aafb4966"
            },
            {
              "fixed": "e9c3252c244b094b9caf6f426ffb77c509e58a9f"
            }
          ],
          "repo": "https://github.com/zephyrproject-rtos/zephyr",
          "type": "GIT"
        }
      ]
    }
  ],
  "aliases": [
    "GHSA-2q4q-gv2c-997j"
  ],
  "database_specific": {
    "cna_assigner": "zephyr",
    "cwe_ids": [
      "CWE-125"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90832.json"
  },
  "details": "bt_hci_le_per_adv_report_common() in subsys/bluetooth/host/scan.c handles the HCI_LE_Periodic_Advertising_Report (and _v2) event. It verified that the fixed event header was present and that the controller-declared Data_Length fits the tailroom of the periodic-sync reassembly buffer, but never checked that the event actually carried as many data bytes as evt-\u003elength claims. Both reassembly paths — DATA_STATUS_PARTIAL, and DATA_STATUS_COMPLETE while a chain is already in progress — then called net_buf_simple_add_mem(\u0026per_adv_sync-\u003ereassembly, buf-\u003edata, evt-\u003elength), copying up to 255 bytes starting past the end of the event's real payload.\n\nThe Data_Length field originates in the HCI controller, so the flaw is reachable in host-only/split builds where the controller is a separate part reached over H4 UART, SPI, USB or an inter-core IPC transport: a malicious, compromised or buggy controller (or an attacker able to inject on that link) can send a report declaring a length larger than the event payload. The generic event dispatcher in subsys/bluetooth/host/hci_core.c only enforces a per-event minimum length and never cross-checks the subevent's internal length field, so nothing else catches it. Builds using Zephyr's own in-image controller are not affected, because the controller always emits a length matching the bytes it appends.\n\nExploitation additionally requires CONFIG_BT_PER_ADV_SYNC with CONFIG_BT_PER_ADV_SYNC_BUF_SIZE \u003e 0 (the option defaults to 0, which compiles the reassembly block out; LE Audio broadcast-sink and Public Broadcast Profile applications that reassemble fragmented periodic advertising data set it), and an established periodic advertising sync.\n\nThe consequence is an out-of-bounds read of adjacent HCI RX-pool memory — including stale contents of previously received HCI events — which is copied into the reassembly buffer and then delivered to every registered bt_le_per_adv_sync_cb.recv listener as if it were received advertising data, so the disclosed memory becomes application-visible and may be forwarded off-device. The write side remains in bounds because the tailroom check uses the same length value, so there is no memory corruption; impact is limited to information disclosure and undefined behaviour on the over-read. The fix drops any report whose declared length exceeds the remaining event payload, matching the guard already present in the extended and legacy advertising report handlers.",
  "id": "CVE-2026-90832",
  "modified": "2026-11-12T02:31:07.204352404Z",
  "published": "2026-11-10T22:07:37.866Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90832.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-2q4q-gv2c-997j"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90832"
    },
    {
      "type": "FIX",
      "url": "https://github.com/zephyrproject-rtos/zephyr/commit/e9c3252c244b094b9caf6f426ffb77c509e58a9f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/zephyrproject-rtos/zephyr"
    }
  ],
  "schema_version": "1.9.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Out-of-bounds read in Bluetooth Host periodic advertising report reassembly due to unvalidated report length"
}