{"id":"CVE-2026-77685","summary":"Bluetooth Classic RFCOMM: integer underflow in the MCC TEST command handler leads to out-of-bounds read disclosed to the peer and out-of-bounds write","details":"The RFCOMM multiplexer control-channel handler in subsys/bluetooth/host/classic/rfcomm.c computed the echo length for a BT_RFCOMM_TEST command as buf-\u003elen - 1 and passed it to rfcomm_send_test(), whose length parameter is a uint8_t. A malformed but FCS-valid UIH frame on DLCI 0 can leave buf-\u003elen == 0 after rfcomm_handle_msg() pulls the two-byte MCC header, so buf-\u003elen - 1 underflows and narrows to 255.\n\nrfcomm_send_test() then copies 255 bytes out of a receive buffer that holds no remaining valid data, and appends them to an outgoing L2CAP PDU allocated with only CONFIG_BT_L2CAP_TX_MTU (253 by default for CONFIG_BT_CLASSIC) bytes of tailroom. The source read runs past the end of the ACL receive buffer into adjacent buffers of the same net_buf pool, and the destination copy overruns the transmit buffer by about eight bytes; net_buf_add_mem() performs no runtime bounds check in ordinary builds, where the underlying __ASSERT_NO_MSG() is compiled out.\n\nThe trigger is a single five-byte RFCOMM frame on the multiplexer control channel, which is processed as soon as the L2CAP channel for PSM 3 is established — before any DLC exists and independent of RFCOMM session state. bt_rfcomm_init() registers that L2CAP server with .sec_level = BT_SECURITY_L1, which l2cap_br_conn_security() accepts without any link key from a peer that does not claim host Secure Simple Pairing support, so an unpaired BR/EDR device in radio range of a connectable target with CONFIG_BT_RFCOMM enabled (SPP, HFP, HSP, GOEP and similar profiles all enable it) can reach the defect.\n\nThe resulting 255-byte TEST response is transmitted back to the attacker, disclosing roughly 255 bytes of adjacent stack/pool memory — including the contents of neighbouring receive buffers, which an attacker can prime with earlier packets — and the accompanying out-of-bounds write corrupts memory following the transmit buffer, which can crash the Bluetooth host. The request is trivially repeatable, so both the disclosure and the corruption can be driven at will.\n\nTwo fixes are needed, and the first on its own does not close the out-of-bounds write. Fix 1 (0040ef781e1d, #115768) strips the FCS byte in rfcomm_recv() and echoes buf-\u003elen, rejecting anything over UINT8_MAX, which removes the underflow and the over-read. But rfcomm_make_uih_msg() still allocates the response with bt_l2cap_create_pdu() and never compares the requested length with the buffer's tailroom, so a well-formed TEST command carrying a pattern of about 248 bytes or more still builds a response (3-byte frame header, 2-byte message header, pattern, FCS) larger than the 253 bytes available. A pattern that long can only be received when the RFCOMM L2CAP receive MTU (CONFIG_BT_RFCOMM_L2CAP_MTU, which defaults to CONFIG_BT_BUF_ACL_RX_SIZE) exceeds CONFIG_BT_L2CAP_TX_MTU. The plain BR/EDR defaults (200 against 253) cannot reach it, but from v4.3.0 enabling CONFIG_BT_GOEP raises CONFIG_BT_BUF_ACL_RX_SIZE to 264 (265 from v4.4.0), so GOEP builds with only fix 1 applied still overrun the transmit buffer by up to eight bytes. This includes v4.3.2, the last v4.3 release, which carries fix 1 but will not receive fix 2. Fix 2 (214530895dd3, #118293) checks the tailroom on every RFCOMM PDU allocation and closes this residual write.","aliases":["GHSA-mhhp-8w67-cggv"],"modified":"2026-11-11T13:25:14.570765549Z","published":"2026-11-10T22:07:41.411Z","database_specific":{"cna_assigner":"zephyr","cwe_ids":["CWE-125","CWE-191","CWE-787"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77685.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77685.json"},{"type":"PACKAGE","url":"https://github.com/zephyrproject-rtos/zephyr"},{"type":"FIX","url":"https://github.com/zephyrproject-rtos/zephyr/commit/0040ef781e1d705066045850782cd8efa5beaa02"},{"type":"FIX","url":"https://github.com/zephyrproject-rtos/zephyr/commit/214530895dd327ef34468fb25e132df6976e927c"},{"type":"ADVISORY","url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-mhhp-8w67-cggv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77685"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/zephyrproject-rtos/zephyr","events":[{"introduced":"bdc3107d5c47d9cf4b6a4e948186a0a2730d92c5"},{"fixed":"41d10b59730406bbab4ca9f1fbbe9e96aafb4966"},{"fixed":"0040ef781e1d705066045850782cd8efa5beaa02"},{"fixed":"214530895dd327ef34468fb25e132df6976e927c"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"1.7.0"},{"fixed":"4.5.0"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"0040ef781e1d705066045850782cd8efa5beaa02"}]},{"source":"REFERENCES_COMMIT","range":[{"fixed":"214530895dd327ef34468fb25e132df6976e927c"}]}]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-77685.json","vanir_signatures":[{"id":"CVE-2026-77685-0e1cd5bf","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/214530895dd327ef34468fb25e132df6976e927c","target":{"file":"subsys/bluetooth/host/classic/rfcomm.c","function":"rfcomm_handle_rls"},"deprecated":false,"digest":{"function_hash":"89200609542080925956120724730815652242","length":513}},{"source":"https://github.com/zephyrproject-rtos/zephyr/commit/214530895dd327ef34468fb25e132df6976e927c","target":{"file":"subsys/bluetooth/host/classic/rfcomm.c","function":"rfcomm_session_disconnect"},"deprecated":false,"digest":{"function_hash":"67565689660704620972929431071703660713","length":225},"id":"CVE-2026-77685-131096eb","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"length":324,"function_hash":"177904448078974921985360838493266603664"},"id":"CVE-2026-77685-2242e896","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/214530895dd327ef34468fb25e132df6976e927c","target":{"function":"rfcomm_send_test","file":"subsys/bluetooth/host/classic/rfcomm.c"}},{"target":{"function":"rfcomm_session_rtx_timeout","file":"subsys/bluetooth/host/classic/rfcomm.c"},"deprecated":false,"digest":{"length":470,"function_hash":"49448988511267724350879149397242512173"},"id":"CVE-2026-77685-22f8c682","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/214530895dd327ef34468fb25e132df6976e927c"},{"signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/214530895dd327ef34468fb25e132df6976e927c","target":{"file":"subsys/bluetooth/host/classic/rfcomm.c","function":"rfcomm_send_pn"},"deprecated":false,"digest":{"function_hash":"204088227086830366503947938795596384372","length":943},"id":"CVE-2026-77685-2408f689","signature_type":"Function"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/214530895dd327ef34468fb25e132df6976e927c","target":{"file":"subsys/bluetooth/host/classic/rfcomm.c","function":"rfcomm_send_nsc"},"deprecated":false,"digest":{"function_hash":"36548009509625906596509761160158676428","length":312},"id":"CVE-2026-77685-26b2bc80"},{"signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/0040ef781e1d705066045850782cd8efa5beaa02","target":{"file":"subsys/bluetooth/host/classic/rfcomm.c","function":"rfcomm_handle_pn"},"deprecated":false,"digest":{"function_hash":"56782219786207131940212912962368374538","length":1726},"id":"CVE-2026-77685-27b8979d","signature_type":"Function"},{"digest":{"function_hash":"186754364571449985562916710300446229526","length":433},"id":"CVE-2026-77685-32badf99","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/214530895dd327ef34468fb25e132df6976e927c","target":{"function":"rfcomm_send_msc","file":"subsys/bluetooth/host/classic/rfcomm.c"},"deprecated":false},{"source":"https://github.com/zephyrproject-rtos/zephyr/commit/214530895dd327ef34468fb25e132df6976e927c","target":{"function":"rfcomm_make_uih_msg","file":"subsys/bluetooth/host/classic/rfcomm.c"},"deprecated":false,"digest":{"function_hash":"193152231225918631843814522796890743926","length":548},"id":"CVE-2026-77685-34268562","signature_type":"Function","signature_version":"v1"},{"target":{"file":"subsys/bluetooth/host/classic/rfcomm.c","function":"rfcomm_dlc_connected"},"deprecated":false,"digest":{"length":805,"function_hash":"60291459950672946265467665541949869961"},"id":"CVE-2026-77685-355bd5ba","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/214530895dd327ef34468fb25e132df6976e927c"},{"source":"https://github.com/zephyrproject-rtos/zephyr/commit/0040ef781e1d705066045850782cd8efa5beaa02","target":{"file":"subsys/bluetooth/host/classic/rfcomm.c","function":"rfcomm_handle_data"},"deprecated":false,"digest":{"length":932,"function_hash":"117655370843203086927732485915989966385"},"id":"CVE-2026-77685-36e23fe1","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-77685-3b495207","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/0040ef781e1d705066045850782cd8efa5beaa02","target":{"file":"subsys/bluetooth/host/classic/rfcomm.c","function":"rfcomm_handle_msc"},"deprecated":false,"digest":{"length":591,"function_hash":"282801140375911836437314331860503130378"}},{"source":"https://github.com/zephyrproject-rtos/zephyr/commit/0040ef781e1d705066045850782cd8efa5beaa02","target":{"file":"subsys/bluetooth/host/classic/rfcomm.c","function":"rfcomm_handle_msg"},"deprecated":false,"digest":{"function_hash":"166156774737283779964291318746776402984","length":1431},"id":"CVE-2026-77685-5f3d5ef9","signature_type":"Function","signature_version":"v1"},{"digest":{"length":1654,"function_hash":"340238115475941062350346028877066641487"},"id":"CVE-2026-77685-65f7ac59","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/214530895dd327ef34468fb25e132df6976e927c","target":{"file":"subsys/bluetooth/host/classic/rfcomm.c","function":"rfcomm_handle_msg"},"deprecated":false},{"target":{"function":"rfcomm_send_sabm","file":"subsys/bluetooth/host/classic/rfcomm.c"},"deprecated":false,"digest":{"length":479,"function_hash":"259092827910161690742518623250439359398"},"id":"CVE-2026-77685-669a54d4","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/214530895dd327ef34468fb25e132df6976e927c"},{"target":{"function":"rfcomm_dlc_close","file":"subsys/bluetooth/host/classic/rfcomm.c"},"deprecated":false,"digest":{"function_hash":"277826994064089758626907748014666169738","length":803},"id":"CVE-2026-77685-6b0ed1af","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/214530895dd327ef34468fb25e132df6976e927c"},{"id":"CVE-2026-77685-735d5883","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/214530895dd327ef34468fb25e132df6976e927c","target":{"file":"subsys/bluetooth/host/classic/rfcomm.c","function":"rfcomm_dlc_start"},"deprecated":false,"digest":{"function_hash":"219193186081405974924804912404466901027","length":483}},{"id":"CVE-2026-77685-7bf3adaf","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/0040ef781e1d705066045850782cd8efa5beaa02","target":{"function":"rfcomm_handle_rpn","file":"subsys/bluetooth/host/classic/rfcomm.c"},"deprecated":false,"digest":{"length":950,"function_hash":"177473682141907600034047441173588322527"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/214530895dd327ef34468fb25e132df6976e927c","target":{"file":"subsys/bluetooth/host/classic/rfcomm.c","function":"rfcomm_send_disc"},"deprecated":false,"digest":{"function_hash":"215882929457875108696437178231021128056","length":512},"id":"CVE-2026-77685-8b7eb129"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/0040ef781e1d705066045850782cd8efa5beaa02","target":{"file":"subsys/bluetooth/host/classic/rfcomm.c","function":"rfcomm_recv"},"deprecated":false,"digest":{"function_hash":"61068645741793131534671631735176659257","length":1560},"id":"CVE-2026-77685-8df6746c"},{"deprecated":false,"digest":{"length":510,"function_hash":"303433482784815787229482744843935775089"},"id":"CVE-2026-77685-986032c9","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/214530895dd327ef34468fb25e132df6976e927c","target":{"file":"subsys/bluetooth/host/classic/rfcomm.c","function":"rfcomm_send_dm"}},{"signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/214530895dd327ef34468fb25e132df6976e927c","target":{"file":"subsys/bluetooth/host/classic/rfcomm.c","function":"rfcomm_send_rpn"},"deprecated":false,"digest":{"length":335,"function_hash":"84071977120925031872816530168598036609"},"id":"CVE-2026-77685-98cf62b2","signature_type":"Function"},{"deprecated":false,"digest":{"length":477,"function_hash":"142177892062529445077156053468270898120"},"id":"CVE-2026-77685-9ad61f94","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/214530895dd327ef34468fb25e132df6976e927c","target":{"file":"subsys/bluetooth/host/classic/rfcomm.c","function":"rfcomm_send_ua"}},{"target":{"file":"subsys/bluetooth/host/classic/rfcomm.c","function":"rfcomm_encrypt_change"},"deprecated":false,"digest":{"function_hash":"116366398748898671720947523104349762680","length":735},"id":"CVE-2026-77685-a3b049ec","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/214530895dd327ef34468fb25e132df6976e927c"},{"deprecated":false,"digest":{"function_hash":"179743362208899383287213290925077781427","length":1877},"id":"CVE-2026-77685-b1389d88","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/214530895dd327ef34468fb25e132df6976e927c","target":{"file":"subsys/bluetooth/host/classic/rfcomm.c","function":"rfcomm_handle_pn"}},{"deprecated":false,"digest":{"length":735,"function_hash":"116552246259956393353519956960444211651"},"id":"CVE-2026-77685-b67d3d85","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/214530895dd327ef34468fb25e132df6976e927c","target":{"file":"subsys/bluetooth/host/classic/rfcomm.c","function":"rfcomm_handle_sabm"}},{"signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/214530895dd327ef34468fb25e132df6976e927c","target":{"file":"subsys/bluetooth/host/classic/rfcomm.c","function":"rfcomm_send_credit"},"deprecated":false,"digest":{"function_hash":"161444261456493000628676560608061248312","length":585},"id":"CVE-2026-77685-b9c3f35f","signature_type":"Function"},{"target":{"file":"subsys/bluetooth/host/classic/rfcomm.c"},"deprecated":false,"digest":{"line_hashes":["241740055852819581379730484839906639755","63931298022346940927611224337158564666","77922670448482808164070290530499337958","317640404162228694314462687329033982731","94255745742780728821510755357009743115","18768547890605307856680464022726073547","191532840646485170024147782537069789875","265929219245513353094851212310315964791","148975073885180279883932743826730402527","190201867127528533400660621231465876094","222954054740790230201395843225736233996","239904108705712056645830030906732835264","148975073885180279883932743826730402527","247211216496589583866511145574404507319","260771567187107856921730643250420778770","182912609635500288841310483796534922125","120293380926966638110791915807368674395","85933355442520495079555202006381464967","134290947308079528183428215177652492326","75902129031492949353664521854416627077","273311737758840906859991574266824991871","178486276703382765724017250021138718175","156439698961856662224937529483814180322","47927977729988177884530603688682600260","21006131129204297934142913629379801125","47406647933104639003621443421983635134","215576619682624726429026161931708615648","217152137855867890361405087282329251631","245412774391455562849911447887000986682","22302098096108862773408087746173426919","40654966315888901373106105162436251663","100542354343159743429446997535435541141","21946323763121354623622594725115036368","81949422809702656187511033322316117557","165318209997643700008224621947454137167","3878736444436163309162897714209439791","9545278327607130568499897706391103404","134945170989397776636795802546643406697","137543561686430315109031202535446439727","238944237783437876419185718593853665866","312566036018174690661862321973698808058","136249300055514732780730012985693304261","95118809750632640686097516279359660547","154846557953310187440381024458447275263","329749674217479308121819312995243948804","168077935307229036323693323325109930798","119388343348560268310816256698246302238","235980868852954496433613540983615870945","88742924717267527830667598810171768953","101441644587270476180568133338866577275","228133410608452330457646373358269075241","67023307578424237310878063019197296469","190201867127528533400660621231465876094","222954054740790230201395843225736233996","59056192795934537157084898191509044538","135171278731265024958919018366349251787","18768547890605307856680464022726073547","191532840646485170024147782537069789875","148663849636453588916027956618796387262","135171278731265024958919018366349251787","82709956033202948042533766685497146224","79353608171545933040774160421554293478","49731489882106415078913156259201019335","164489186164440108347858463437409779898","179358225288470780193228717216221943915","128522927880870781571465369954013721753","202849178872050969659709989308428057083","146984651121573301385661559118210320274","17824594457799843529932525714516131863","119259585241190670749630452267928380846","227877968294483326881048061974360833331","58196608970318932867921292642803128422","163535936067998689197561841682746909423","194479940069449187591392999770536737657","103561993383295845279242192581064747150","163244541259447001024548573979801977701","287902712896671982484868317350532130299","95302295523970842828863649486906492495","122131912887325926345527820464819216233","135645361806023376845620518315566461944","182754984865023201732326185979404778753","140940782528203301970343149601064684318","82359147849767743083283357126794975184","101293212041660794141556631816323723091","56856145285668814020842838747522710834","242836450184497777224592687974009599457","16849992440622615781233628315276074673","229365221150871429156748697725946674159","274655234221500732670422743956793028128","305745276700212372758927528116710155223","59867609232746454608636979232155100195","74372059001955103445175005309150774223","261463566485200607797722581822182529980","205777397525894052951738888587341527204","119934116966696441956265169403293029084","69836697061132001381392518267989477132","70198392843010637050532772196356479228","116474394621136377523546246418287023863","160847787665062715178909916960735486151","225937302499777858060295601167852169326","191248652593019493371877970331802362445","39856580530850550715931902336995018476","112255845606901597703438248759497664728","101476834872153502477396817099077047853","1379840324538734280386639195974051465","271840336643719528786375566326317160598","338175283155246072726962151837602375169","79764604271563468739630642122484678114","1903616414314165251110826131398880103","71100368724110748673497424002253865557","11347192233101714129013163428065416343","13658164452343717560245322936477037844","86646209216823035778713505600619103316","217250721545536869076932447957148725237","77020249460945540577766028311932934707","297651559881980059844747597454580114459","279900242189123135039323711450643717299","231862575660210704572832007015928647446","14268341367986428561108366925968456009","340037924259879000417551083604013743941","164823538956106382382619022123919536796","86894885369896359791206862706548996994","141872879999750554005296235704010416773","279780814604194184096491684517937044054","76338134077992622122384966307936743100","267453924410560365826764093187260086434","286739155743410942621248675411620299389","45638798855330011772986132535260069139","335370086601045595429715191321528258104","280925745668787493475620425261092543217","159336590045136839968756705795766826963","28040805363494251755713066474928174248","268072346897203605860656572554294218672","34527442025792730683777187838550525602","335460937574976764046217089180102627917","67845573643359085833825484885293099706","30957648471367822832078462662690780303","185350807040326776735831895302693247180","171889393496421593787774086378098380469","337040239473363773061375811267393263839","61032484282126341890808374265700241968","96937134224608867411890002634074455833","25094579440050736664227171633679881766","260790016280578134948817912828423848508","98247172686379452129844103930490900715","256744959013059385302811533907956613480","249363708371785656842811839079072696373","237192228059323770217769502827620634476","280532420620112693469942990468893873794","25123699982377732632651195463268895369","163985925129875775650146388739108943538","274860581957950090674009994433206010497","141005787550205215556274099999114555543","69945266128225426803292039849332850611","128388098592629319319792072927283656463","129241943791244036685214155158075782855","164851259876550009649669556231966980459","21800574706620606635131976585541901166","115753286068498566503109148003563394155","187404448115913239912946351153782004813","132315187970420626247556183509005091359","322250385498570128884908771874916767010","66253719477233358958691180633115908898","40930006995607022401693259684763417210","126028777635622989990291383276112388505","328129449045360109244240334766529951151","332864463746083008081378948656217790902","43163761136894395674880380732070142299","44769867042369923703925752350983982288","32662404006467432879853434984629194889","220039548726513144263450071888707880788","27669370383083929916332471568725319459","212671367766786205947403261866926053746","328221728820682735447750924372483290643","1154749377788048586959530654304996331","284221926516431226866110798235018110040","16397929786711104031331597159018494277","309189959825794916897790897982560764841","59649745257745023978374783692183638445","156661090096838257733375940467113062687","37428755351112618437275763947929167017","54301767168096067390949842389561830834","168544269016578347932369420968438331490","184855868586271238566775683519445223292","270077794978436943838032379016977309458","247914330888409830678321358856133730443","275139226348964441929822265492122740342","225078825659826018806728081816167847023","236979206221732620226488701367900909468","83736264491320233075810657585098769381","79921946871857068666321568915238356849","39546334233897207210402993338301407686","160493371093869780617213361498520553212","329989855051500815216521637443353473160","251332201106101197583205546081420513036","34507992394707854949229627698043233587","333580567077918682725776520247038996554","294053501231317639464000291647565412450","237519660804198566437235223112371263470","283376785913365448890261193406578355584","220347397362309527263394307982822900707","135723471591979085113329736675568425062","3217822139885626782444301225003896798","11425658631241869684695864416624168835","294207030017340830404677657760302950897","19648818186364780656394056182526712594","265876742676343580100773002937729868147","308010620239601527602436072892223714105","337040239473363773061375811267393263839","337422413369008685773818859800428373245","236823205624448488346344508822122996465","207815410039211529741164295443592147456","157074109574043508543022324139789693619","96749411332848981385627316180661537507","320141292827646875633277546530951136953","75871118699594530266310352318929574250","231262364501706879544704706659053740156","271444503804196947609013612672423443132","90464727520947414804241631191973385599","51078071409110526507924924844043434212","45759414325514993816810709150841043927","20456676459143497354202454027805854740","270520423371998252176976504726336066800","88202473581153679695283844849554702891","29477869838466838877681034473284499919","29262330249239935507096452613995489086","154146183442644192967853705513836034736","82445053851085749281786117422196600975","170526570866658698588506410396129078909","183337345143948085521958742334679519444","221867536964797541596469044314960695082","191320501377564815291656840057508344414","119464786827419532421695469167970026496","131895154033424310900440509613290273175","153818607372018396717236094927962186083","178188004261477905766680398858968495018","40262587731506658117430730644960234088","218050472156016723813718687642606938363","175234760861461770134605733479763869289","285906889300409334916159248682292701704","265516929903800947577458874115115676082","312420994309362943579064903645377379727","122733398216663994104914677833894535578","211914812363280204655171102112220866342","77191580561475729098614221620996851927","260059890594483067276543673246957666994","189175746375276511708776799831191281710","199317129862825533336630336210917491870","91549912984208775983018302430247696811","80817367256835811742658412647965101278","269354441417027613575694457362104826368","139283833428105073077755370597292216538","54673835210473233116335109197960711582","21174287050680792830811687090000453889","266659650198371810152165882730681672033","49952343774444681656219903082815094522","61868131628201685269563423096647962558","161670517223910837382530657957095852523","248477742790931687131205110688474031531","19436218809657165732077551604601149373","312248434999038661245629875608081604147","265971394529959307766611349421679873819","306919543743493485939416952182694329518","21108996823097451612250932975543319500","141909479133156158154610619983404774577","259198806472612047787989298329892996695","149893436147211353806247266954036609582"],"threshold":0.9},"id":"CVE-2026-77685-bafb5589","signature_type":"Line","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/214530895dd327ef34468fb25e132df6976e927c"},{"source":"https://github.com/zephyrproject-rtos/zephyr/commit/214530895dd327ef34468fb25e132df6976e927c","target":{"file":"subsys/bluetooth/host/classic/rfcomm.c","function":"rfcomm_send_rls"},"deprecated":false,"digest":{"function_hash":"120245288254565913647253510281458697802","length":433},"id":"CVE-2026-77685-c6c1e61f","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/0040ef781e1d705066045850782cd8efa5beaa02","target":{"file":"subsys/bluetooth/host/classic/rfcomm.c","function":"rfcomm_handle_rls"},"deprecated":false,"digest":{"function_hash":"306340915651908414768859400854560922771","length":355},"id":"CVE-2026-77685-c8ffdd7e","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"140519763987145995763773557346763317203","length":1596},"id":"CVE-2026-77685-cadfaa4d","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/214530895dd327ef34468fb25e132df6976e927c","target":{"file":"subsys/bluetooth/host/classic/rfcomm.c","function":"rfcomm_dlc_tx_worker"}},{"source":"https://github.com/zephyrproject-rtos/zephyr/commit/214530895dd327ef34468fb25e132df6976e927c","target":{"file":"subsys/bluetooth/host/classic/rfcomm.c","function":"rfcomm_send_fcon"},"deprecated":false,"digest":{"function_hash":"291993629123781155147724510143712667178","length":255},"id":"CVE-2026-77685-ddbf181a","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-77685-e820a9f1","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/214530895dd327ef34468fb25e132df6976e927c","target":{"function":"rfcomm_handle_rpn","file":"subsys/bluetooth/host/classic/rfcomm.c"},"deprecated":false,"digest":{"function_hash":"86924502606831741474358400003611016936","length":1136}},{"source":"https://github.com/zephyrproject-rtos/zephyr/commit/214530895dd327ef34468fb25e132df6976e927c","target":{"file":"subsys/bluetooth/host/classic/rfcomm.c","function":"rfcomm_send_fcoff"},"deprecated":false,"digest":{"length":256,"function_hash":"38796652897808894926971044981228619631"},"id":"CVE-2026-77685-e8f3c1bb","signature_type":"Function","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/214530895dd327ef34468fb25e132df6976e927c","target":{"file":"subsys/bluetooth/host/classic/rfcomm.c","function":"rfcomm_handle_disc"},"deprecated":false,"digest":{"function_hash":"75944068858568469869206973247869124179","length":452},"id":"CVE-2026-77685-ebc618ab"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/0040ef781e1d705066045850782cd8efa5beaa02","target":{"file":"subsys/bluetooth/host/classic/rfcomm.c"},"deprecated":false,"digest":{"line_hashes":["94742817788578325046201078070226653586","122337637571299354135927541606001368648","115418854533666070477041238769565458198","104261731447957859919494727626335701877","322393406012585493388893554086318480433","196143266195301869826990854846576981187","325766401307751182688571900026988321820","226230523139300167793958863784799390099","170245471592264396205003483486339080088","104861644610326441345660754384522016003","139642155624886369841122014918381686594","324854248226654675695461101928469681032","261722624653014817327177374900418836430","63187312574353524047274886086540842708","152874093995965895523939035538275120761","274156382318683288881806044699618173628","269269505152698326926189554164777203072","157616763290205389532534300541919293356","107839816734384682081318569842034205984","214757018325013906221827271801451599877","311901078448059286457828370295971575495","324190802815263520395832319480761515656","276024951717505918993300100872046574349","45061043577267687341795451843191508120","49234962281866262847551390641547719301","307636333472773909974269884232455111072","314372909750544833809224861538545452883","249855272298979296711708929703402618372","227959920669477414834645930014431209179","315854528138045936112777491804860524506","199519704961782571074815477850810291896","295617969347705664437699753547155244841","130211733695743981611922170638287626360","249422131398255096015344069163428145032","240828617857551583843833199893998590045","145618923264916537141572118606035634895","87679143994786077782838160649435380136","57659260510493055293847594909581744131","185613910568462425484679335178529697880","272831344077265697820673625966422200589","305339517508922771280488360789054271818","98401001389760426852668289792964668331","14108398626474104122402464550364540842","103815238639987284504739631031815615958","278268907296195400716823497220338502256","256791321089505265739068521819256214612","194434587581289529521245585344185696250","98620258673964579375034273754229427178","100459722728965167491559615389056640732","277820657702280714112971265841587599065","72419247352735801857391725316496473519","304150890524403260843829374188764957697","209181418596649079329723352376355153104","312404177837943853574444798499215509046","122486618252967717768084368911378122143","176967413238999487306550689860045266707","43427907790863669068336732546768024883","267532019503201041708884288341377915264","66862326592046886668928497699942943248","172568621787779552349341297540811782954","51256706465679948093439378964053730943","32352840998013767770037520936539582955","85828084262869619283229815033888471959","40973100371502124547395328120564720424","147827271653677569427722743752426965638","39727478095024417737223944414506335375","105347715939079962592425073604344045564","101327704507192158517414196303260814057","142798029406498882698621686259489698211","150323710736099105664433463030252951547","258683479742092736386578614063347843759","184623784195383582409945848923307127316","99842832813709204462311345271108114619","22337945791618933376689237208955359173","298903143091101772734233764674465881073","211932577157025848673359901445511641876","167934987052194309229393535129697679221","56046578093081311942569355776273931322","145510217317141103871318078581624164800","164383810704952444609162168488179016379"],"threshold":0.9},"id":"CVE-2026-77685-ec5d6383"},{"deprecated":false,"digest":{"length":749,"function_hash":"158550029552616392750631939341554445889"},"id":"CVE-2026-77685-ecfac23c","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/214530895dd327ef34468fb25e132df6976e927c","target":{"file":"subsys/bluetooth/host/classic/rfcomm.c","function":"rfcomm_handle_msc"}},{"deprecated":false,"digest":{"length":623,"function_hash":"200277953402043145309222713369716644397"},"id":"CVE-2026-77685-eeeb020d","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/214530895dd327ef34468fb25e132df6976e927c","target":{"file":"subsys/bluetooth/host/classic/rfcomm.c","function":"rfcomm_connected"}},{"target":{"function":"rfcomm_handle_data","file":"subsys/bluetooth/host/classic/rfcomm.c"},"deprecated":false,"digest":{"function_hash":"175423592694152033071143256907402985404","length":1326},"id":"CVE-2026-77685-ffd03045","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/214530895dd327ef34468fb25e132df6976e927c"}],"vanir_signatures_modified":"2026-11-11T13:25:14Z"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H"}]}