CVE-2026-79982

The Bluetooth HCI USB transport class in subsys/usb/device_next/class/bt_hci.c contains an out-of-bounds write vulnerability. The bt_hci_tx_sync_in() function allocates a buffer from bt_hci_ep_pool (fixed at 64 bytes on full-speed-only builds) and uses net_buf_add_mem() to copy controller-to-host...