CVE-2026-77685
- Source
- https://cve.org/CVERecord?id=CVE-2026-77685
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-77685.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-77685
- Aliases
-
- GHSA-mhhp-8w67-cggv
- Published
- 2026-11-10T22:07:41Z
- Modified
- 2026-11-11T13:25:14Z
- Severity
-
- 8.3 (High) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H CVSS Calculator
- Summary
- Bluetooth Classic RFCOMM: integer underflow in the MCC TEST command handler leads to out-of-bounds read disclosed to the peer and out-of-bounds write
- Details
-
The RFCOMM multiplexer control-channel handler in subsys/bluetooth/host/classic/rfcomm.c computed the echo length for a BT_RFCOMM_TEST command as buf->len - 1 and passed it to rfcomm_send_test(), whose length parameter is a uint8_t. A malformed but FCS-valid UIH frame on DLCI 0 can leave buf->len == 0 after rfcomm_handle_msg() pulls the two-byte MCC header, so buf->len - 1 underflows and narrows to 255.
rfcomm_send_test() then copies 255 bytes out of a receive buffer that holds no remaining valid data, and appends them to an outgoing L2CAP PDU allocated with only CONFIG_BT_L2CAP_TX_MTU (253 by default for CONFIG_BT_CLASSIC) bytes of tailroom. The source read runs past the end of the ACL receive buffer into adjacent buffers of the same net_buf pool, and the destination copy overruns the transmit buffer by about eight bytes; net_buf_add_mem() performs no runtime bounds check in ordinary builds, where the underlying __ASSERT_NO_MSG() is compiled out.
The trigger is a single five-byte RFCOMM frame on the multiplexer control channel, which is processed as soon as the L2CAP channel for PSM 3 is established — before any DLC exists and independent of RFCOMM session state. bt_rfcomm_init() registers that L2CAP server with .sec_level = BT_SECURITY_L1, which l2cap_br_conn_security() accepts without any link key from a peer that does not claim host Secure Simple Pairing support, so an unpaired BR/EDR device in radio range of a connectable target with CONFIG_BT_RFCOMM enabled (SPP, HFP, HSP, GOEP and similar profiles all enable it) can reach the defect.
The resulting 255-byte TEST response is transmitted back to the attacker, disclosing roughly 255 bytes of adjacent stack/pool memory — including the contents of neighbouring receive buffers, which an attacker can prime with earlier packets — and the accompanying out-of-bounds write corrupts memory following the transmit buffer, which can crash the Bluetooth host. The request is trivially repeatable, so both the disclosure and the corruption can be driven at will.
Two fixes are needed, and the first on its own does not close the out-of-bounds write. Fix 1 (0040ef781e1d, #115768) strips the FCS byte in rfcomm_recv() and echoes buf->len, rejecting anything over UINT8_MAX, which removes the underflow and the over-read. But rfcomm_make_uih_msg() still allocates the response with bt_l2cap_create_pdu() and never compares the requested length with the buffer's tailroom, so a well-formed TEST command carrying a pattern of about 248 bytes or more still builds a response (3-byte frame header, 2-byte message header, pattern, FCS) larger than the 253 bytes available. A pattern that long can only be received when the RFCOMM L2CAP receive MTU (CONFIG_BT_RFCOMM_L2CAP_MTU, which defaults to CONFIG_BT_BUF_ACL_RX_SIZE) exceeds CONFIG_BT_L2CAP_TX_MTU. The plain BR/EDR defaults (200 against 253) cannot reach it, but from v4.3.0 enabling CONFIG_BT_GOEP raises CONFIG_BT_BUF_ACL_RX_SIZE to 264 (265 from v4.4.0), so GOEP builds with only fix 1 applied still overrun the transmit buffer by up to eight bytes. This includes v4.3.2, the last v4.3 release, which carries fix 1 but will not receive fix 2. Fix 2 (214530895dd3, #118293) checks the tailroom on every RFCOMM PDU allocation and closes this residual write.
- Database specific
{ "cna_assigner": "zephyr", "cwe_ids": [ "CWE-125", "CWE-191", "CWE-787" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77685.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77685.json
- https://github.com/zephyrproject-rtos/zephyr
- https://github.com/zephyrproject-rtos/zephyr/commit/0040ef781e1d705066045850782cd8efa5beaa02
- https://github.com/zephyrproject-rtos/zephyr/commit/214530895dd327ef34468fb25e132df6976e927c
- https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-mhhp-8w67-cggv
- https://nvd.nist.gov/vuln/detail/CVE-2026-77685
Affected packages
Git / github.com/zephyrproject-rtos/zephyr
Affected ranges
- Type
- GIT
- Repo
- https://github.com/zephyrproject-rtos/zephyr
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "1.7.0" }, { "fixed": "4.5.0" } ], "source": "AFFECTED_FIELD", "strategy": "StandardRange" }, { "range": [ { "fixed": "0040ef781e1d705066045850782cd8efa5beaa02" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "214530895dd327ef34468fb25e132df6976e927c" } ], "source": "REFERENCES_COMMIT" } ] }
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-77685.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "89200609542080925956120724730815652242",
"length": 513
},
"id": "CVE-2026-77685-0e1cd5bf",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/214530895dd327ef34468fb25e132df6976e927c",
"target": {
"file": "subsys/bluetooth/host/classic/rfcomm.c",
"function": "rfcomm_handle_rls"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "67565689660704620972929431071703660713",
"length": 225
},
"id": "CVE-2026-77685-131096eb",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/214530895dd327ef34468fb25e132df6976e927c",
"target": {
"file": "subsys/bluetooth/host/classic/rfcomm.c",
"function": "rfcomm_session_disconnect"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "177904448078974921985360838493266603664",
"length": 324
},
"id": "CVE-2026-77685-2242e896",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/214530895dd327ef34468fb25e132df6976e927c",
"target": {
"file": "subsys/bluetooth/host/classic/rfcomm.c",
"function": "rfcomm_send_test"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "49448988511267724350879149397242512173",
"length": 470
},
"id": "CVE-2026-77685-22f8c682",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/214530895dd327ef34468fb25e132df6976e927c",
"target": {
"file": "subsys/bluetooth/host/classic/rfcomm.c",
"function": "rfcomm_session_rtx_timeout"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "204088227086830366503947938795596384372",
"length": 943
},
"id": "CVE-2026-77685-2408f689",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/214530895dd327ef34468fb25e132df6976e927c",
"target": {
"file": "subsys/bluetooth/host/classic/rfcomm.c",
"function": "rfcomm_send_pn"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "36548009509625906596509761160158676428",
"length": 312
},
"id": "CVE-2026-77685-26b2bc80",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/214530895dd327ef34468fb25e132df6976e927c",
"target": {
"file": "subsys/bluetooth/host/classic/rfcomm.c",
"function": "rfcomm_send_nsc"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "56782219786207131940212912962368374538",
"length": 1726
},
"id": "CVE-2026-77685-27b8979d",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/0040ef781e1d705066045850782cd8efa5beaa02",
"target": {
"file": "subsys/bluetooth/host/classic/rfcomm.c",
"function": "rfcomm_handle_pn"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "186754364571449985562916710300446229526",
"length": 433
},
"id": "CVE-2026-77685-32badf99",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/214530895dd327ef34468fb25e132df6976e927c",
"target": {
"file": "subsys/bluetooth/host/classic/rfcomm.c",
"function": "rfcomm_send_msc"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "193152231225918631843814522796890743926",
"length": 548
},
"id": "CVE-2026-77685-34268562",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/214530895dd327ef34468fb25e132df6976e927c",
"target": {
"file": "subsys/bluetooth/host/classic/rfcomm.c",
"function": "rfcomm_make_uih_msg"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "60291459950672946265467665541949869961",
"length": 805
},
"id": "CVE-2026-77685-355bd5ba",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/214530895dd327ef34468fb25e132df6976e927c",
"target": {
"file": "subsys/bluetooth/host/classic/rfcomm.c",
"function": "rfcomm_dlc_connected"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "117655370843203086927732485915989966385",
"length": 932
},
"id": "CVE-2026-77685-36e23fe1",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/0040ef781e1d705066045850782cd8efa5beaa02",
"target": {
"file": "subsys/bluetooth/host/classic/rfcomm.c",
"function": "rfcomm_handle_data"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "282801140375911836437314331860503130378",
"length": 591
},
"id": "CVE-2026-77685-3b495207",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/0040ef781e1d705066045850782cd8efa5beaa02",
"target": {
"file": "subsys/bluetooth/host/classic/rfcomm.c",
"function": "rfcomm_handle_msc"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "166156774737283779964291318746776402984",
"length": 1431
},
"id": "CVE-2026-77685-5f3d5ef9",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/0040ef781e1d705066045850782cd8efa5beaa02",
"target": {
"file": "subsys/bluetooth/host/classic/rfcomm.c",
"function": "rfcomm_handle_msg"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "340238115475941062350346028877066641487",
"length": 1654
},
"id": "CVE-2026-77685-65f7ac59",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/214530895dd327ef34468fb25e132df6976e927c",
"target": {
"file": "subsys/bluetooth/host/classic/rfcomm.c",
"function": "rfcomm_handle_msg"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "259092827910161690742518623250439359398",
"length": 479
},
"id": "CVE-2026-77685-669a54d4",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/214530895dd327ef34468fb25e132df6976e927c",
"target": {
"file": "subsys/bluetooth/host/classic/rfcomm.c",
"function": "rfcomm_send_sabm"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "277826994064089758626907748014666169738",
"length": 803
},
"id": "CVE-2026-77685-6b0ed1af",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/214530895dd327ef34468fb25e132df6976e927c",
"target": {
"file": "subsys/bluetooth/host/classic/rfcomm.c",
"function": "rfcomm_dlc_close"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "219193186081405974924804912404466901027",
"length": 483
},
"id": "CVE-2026-77685-735d5883",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/214530895dd327ef34468fb25e132df6976e927c",
"target": {
"file": "subsys/bluetooth/host/classic/rfcomm.c",
"function": "rfcomm_dlc_start"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "177473682141907600034047441173588322527",
"length": 950
},
"id": "CVE-2026-77685-7bf3adaf",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/0040ef781e1d705066045850782cd8efa5beaa02",
"target": {
"file": "subsys/bluetooth/host/classic/rfcomm.c",
"function": "rfcomm_handle_rpn"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "215882929457875108696437178231021128056",
"length": 512
},
"id": "CVE-2026-77685-8b7eb129",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/214530895dd327ef34468fb25e132df6976e927c",
"target": {
"file": "subsys/bluetooth/host/classic/rfcomm.c",
"function": "rfcomm_send_disc"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "61068645741793131534671631735176659257",
"length": 1560
},
"id": "CVE-2026-77685-8df6746c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/0040ef781e1d705066045850782cd8efa5beaa02",
"target": {
"file": "subsys/bluetooth/host/classic/rfcomm.c",
"function": "rfcomm_recv"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "303433482784815787229482744843935775089",
"length": 510
},
"id": "CVE-2026-77685-986032c9",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/214530895dd327ef34468fb25e132df6976e927c",
"target": {
"file": "subsys/bluetooth/host/classic/rfcomm.c",
"function": "rfcomm_send_dm"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "84071977120925031872816530168598036609",
"length": 335
},
"id": "CVE-2026-77685-98cf62b2",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/214530895dd327ef34468fb25e132df6976e927c",
"target": {
"file": "subsys/bluetooth/host/classic/rfcomm.c",
"function": "rfcomm_send_rpn"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "142177892062529445077156053468270898120",
"length": 477
},
"id": "CVE-2026-77685-9ad61f94",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/214530895dd327ef34468fb25e132df6976e927c",
"target": {
"file": "subsys/bluetooth/host/classic/rfcomm.c",
"function": "rfcomm_send_ua"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "116366398748898671720947523104349762680",
"length": 735
},
"id": "CVE-2026-77685-a3b049ec",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/214530895dd327ef34468fb25e132df6976e927c",
"target": {
"file": "subsys/bluetooth/host/classic/rfcomm.c",
"function": "rfcomm_encrypt_change"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "179743362208899383287213290925077781427",
"length": 1877
},
"id": "CVE-2026-77685-b1389d88",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/214530895dd327ef34468fb25e132df6976e927c",
"target": {
"file": "subsys/bluetooth/host/classic/rfcomm.c",
"function": "rfcomm_handle_pn"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "116552246259956393353519956960444211651",
"length": 735
},
"id": "CVE-2026-77685-b67d3d85",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/214530895dd327ef34468fb25e132df6976e927c",
"target": {
"file": "subsys/bluetooth/host/classic/rfcomm.c",
"function": "rfcomm_handle_sabm"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "161444261456493000628676560608061248312",
"length": 585
},
"id": "CVE-2026-77685-b9c3f35f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/214530895dd327ef34468fb25e132df6976e927c",
"target": {
"file": "subsys/bluetooth/host/classic/rfcomm.c",
"function": "rfcomm_send_credit"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"241740055852819581379730484839906639755",
"63931298022346940927611224337158564666",
"77922670448482808164070290530499337958",
"317640404162228694314462687329033982731",
"94255745742780728821510755357009743115",
"18768547890605307856680464022726073547",
"191532840646485170024147782537069789875",
"265929219245513353094851212310315964791",
"148975073885180279883932743826730402527",
"190201867127528533400660621231465876094",
"222954054740790230201395843225736233996",
"239904108705712056645830030906732835264",
"148975073885180279883932743826730402527",
"247211216496589583866511145574404507319",
"260771567187107856921730643250420778770",
"182912609635500288841310483796534922125",
"120293380926966638110791915807368674395",
"85933355442520495079555202006381464967",
"134290947308079528183428215177652492326",
"75902129031492949353664521854416627077",
"273311737758840906859991574266824991871",
"178486276703382765724017250021138718175",
"156439698961856662224937529483814180322",
"47927977729988177884530603688682600260",
"21006131129204297934142913629379801125",
"47406647933104639003621443421983635134",
"215576619682624726429026161931708615648",
"217152137855867890361405087282329251631",
"245412774391455562849911447887000986682",
"22302098096108862773408087746173426919",
"40654966315888901373106105162436251663",
"100542354343159743429446997535435541141",
"21946323763121354623622594725115036368",
"81949422809702656187511033322316117557",
"165318209997643700008224621947454137167",
"3878736444436163309162897714209439791",
"9545278327607130568499897706391103404",
"134945170989397776636795802546643406697",
"137543561686430315109031202535446439727",
"238944237783437876419185718593853665866",
"312566036018174690661862321973698808058",
"136249300055514732780730012985693304261",
"95118809750632640686097516279359660547",
"154846557953310187440381024458447275263",
"329749674217479308121819312995243948804",
"168077935307229036323693323325109930798",
"119388343348560268310816256698246302238",
"235980868852954496433613540983615870945",
"88742924717267527830667598810171768953",
"101441644587270476180568133338866577275",
"228133410608452330457646373358269075241",
"67023307578424237310878063019197296469",
"190201867127528533400660621231465876094",
"222954054740790230201395843225736233996",
"59056192795934537157084898191509044538",
"135171278731265024958919018366349251787",
"18768547890605307856680464022726073547",
"191532840646485170024147782537069789875",
"148663849636453588916027956618796387262",
"135171278731265024958919018366349251787",
"82709956033202948042533766685497146224",
"79353608171545933040774160421554293478",
"49731489882106415078913156259201019335",
"164489186164440108347858463437409779898",
"179358225288470780193228717216221943915",
"128522927880870781571465369954013721753",
"202849178872050969659709989308428057083",
"146984651121573301385661559118210320274",
"17824594457799843529932525714516131863",
"119259585241190670749630452267928380846",
"227877968294483326881048061974360833331",
"58196608970318932867921292642803128422",
"163535936067998689197561841682746909423",
"194479940069449187591392999770536737657",
"103561993383295845279242192581064747150",
"163244541259447001024548573979801977701",
"287902712896671982484868317350532130299",
"95302295523970842828863649486906492495",
"122131912887325926345527820464819216233",
"135645361806023376845620518315566461944",
"182754984865023201732326185979404778753",
"140940782528203301970343149601064684318",
"82359147849767743083283357126794975184",
"101293212041660794141556631816323723091",
"56856145285668814020842838747522710834",
"242836450184497777224592687974009599457",
"16849992440622615781233628315276074673",
"229365221150871429156748697725946674159",
"274655234221500732670422743956793028128",
"305745276700212372758927528116710155223",
"59867609232746454608636979232155100195",
"74372059001955103445175005309150774223",
"261463566485200607797722581822182529980",
"205777397525894052951738888587341527204",
"119934116966696441956265169403293029084",
"69836697061132001381392518267989477132",
"70198392843010637050532772196356479228",
"116474394621136377523546246418287023863",
"160847787665062715178909916960735486151",
"225937302499777858060295601167852169326",
"191248652593019493371877970331802362445",
"39856580530850550715931902336995018476",
"112255845606901597703438248759497664728",
"101476834872153502477396817099077047853",
"1379840324538734280386639195974051465",
"271840336643719528786375566326317160598",
"338175283155246072726962151837602375169",
"79764604271563468739630642122484678114",
"1903616414314165251110826131398880103",
"71100368724110748673497424002253865557",
"11347192233101714129013163428065416343",
"13658164452343717560245322936477037844",
"86646209216823035778713505600619103316",
"217250721545536869076932447957148725237",
"77020249460945540577766028311932934707",
"297651559881980059844747597454580114459",
"279900242189123135039323711450643717299",
"231862575660210704572832007015928647446",
"14268341367986428561108366925968456009",
"340037924259879000417551083604013743941",
"164823538956106382382619022123919536796",
"86894885369896359791206862706548996994",
"141872879999750554005296235704010416773",
"279780814604194184096491684517937044054",
"76338134077992622122384966307936743100",
"267453924410560365826764093187260086434",
"286739155743410942621248675411620299389",
"45638798855330011772986132535260069139",
"335370086601045595429715191321528258104",
"280925745668787493475620425261092543217",
"159336590045136839968756705795766826963",
"28040805363494251755713066474928174248",
"268072346897203605860656572554294218672",
"34527442025792730683777187838550525602",
"335460937574976764046217089180102627917",
"67845573643359085833825484885293099706",
"30957648471367822832078462662690780303",
"185350807040326776735831895302693247180",
"171889393496421593787774086378098380469",
"337040239473363773061375811267393263839",
"61032484282126341890808374265700241968",
"96937134224608867411890002634074455833",
"25094579440050736664227171633679881766",
"260790016280578134948817912828423848508",
"98247172686379452129844103930490900715",
"256744959013059385302811533907956613480",
"249363708371785656842811839079072696373",
"237192228059323770217769502827620634476",
"280532420620112693469942990468893873794",
"25123699982377732632651195463268895369",
"163985925129875775650146388739108943538",
"274860581957950090674009994433206010497",
"141005787550205215556274099999114555543",
"69945266128225426803292039849332850611",
"128388098592629319319792072927283656463",
"129241943791244036685214155158075782855",
"164851259876550009649669556231966980459",
"21800574706620606635131976585541901166",
"115753286068498566503109148003563394155",
"187404448115913239912946351153782004813",
"132315187970420626247556183509005091359",
"322250385498570128884908771874916767010",
"66253719477233358958691180633115908898",
"40930006995607022401693259684763417210",
"126028777635622989990291383276112388505",
"328129449045360109244240334766529951151",
"332864463746083008081378948656217790902",
"43163761136894395674880380732070142299",
"44769867042369923703925752350983982288",
"32662404006467432879853434984629194889",
"220039548726513144263450071888707880788",
"27669370383083929916332471568725319459",
"212671367766786205947403261866926053746",
"328221728820682735447750924372483290643",
"1154749377788048586959530654304996331",
"284221926516431226866110798235018110040",
"16397929786711104031331597159018494277",
"309189959825794916897790897982560764841",
"59649745257745023978374783692183638445",
"156661090096838257733375940467113062687",
"37428755351112618437275763947929167017",
"54301767168096067390949842389561830834",
"168544269016578347932369420968438331490",
"184855868586271238566775683519445223292",
"270077794978436943838032379016977309458",
"247914330888409830678321358856133730443",
"275139226348964441929822265492122740342",
"225078825659826018806728081816167847023",
"236979206221732620226488701367900909468",
"83736264491320233075810657585098769381",
"79921946871857068666321568915238356849",
"39546334233897207210402993338301407686",
"160493371093869780617213361498520553212",
"329989855051500815216521637443353473160",
"251332201106101197583205546081420513036",
"34507992394707854949229627698043233587",
"333580567077918682725776520247038996554",
"294053501231317639464000291647565412450",
"237519660804198566437235223112371263470",
"283376785913365448890261193406578355584",
"220347397362309527263394307982822900707",
"135723471591979085113329736675568425062",
"3217822139885626782444301225003896798",
"11425658631241869684695864416624168835",
"294207030017340830404677657760302950897",
"19648818186364780656394056182526712594",
"265876742676343580100773002937729868147",
"308010620239601527602436072892223714105",
"337040239473363773061375811267393263839",
"337422413369008685773818859800428373245",
"236823205624448488346344508822122996465",
"207815410039211529741164295443592147456",
"157074109574043508543022324139789693619",
"96749411332848981385627316180661537507",
"320141292827646875633277546530951136953",
"75871118699594530266310352318929574250",
"231262364501706879544704706659053740156",
"271444503804196947609013612672423443132",
"90464727520947414804241631191973385599",
"51078071409110526507924924844043434212",
"45759414325514993816810709150841043927",
"20456676459143497354202454027805854740",
"270520423371998252176976504726336066800",
"88202473581153679695283844849554702891",
"29477869838466838877681034473284499919",
"29262330249239935507096452613995489086",
"154146183442644192967853705513836034736",
"82445053851085749281786117422196600975",
"170526570866658698588506410396129078909",
"183337345143948085521958742334679519444",
"221867536964797541596469044314960695082",
"191320501377564815291656840057508344414",
"119464786827419532421695469167970026496",
"131895154033424310900440509613290273175",
"153818607372018396717236094927962186083",
"178188004261477905766680398858968495018",
"40262587731506658117430730644960234088",
"218050472156016723813718687642606938363",
"175234760861461770134605733479763869289",
"285906889300409334916159248682292701704",
"265516929903800947577458874115115676082",
"312420994309362943579064903645377379727",
"122733398216663994104914677833894535578",
"211914812363280204655171102112220866342",
"77191580561475729098614221620996851927",
"260059890594483067276543673246957666994",
"189175746375276511708776799831191281710",
"199317129862825533336630336210917491870",
"91549912984208775983018302430247696811",
"80817367256835811742658412647965101278",
"269354441417027613575694457362104826368",
"139283833428105073077755370597292216538",
"54673835210473233116335109197960711582",
"21174287050680792830811687090000453889",
"266659650198371810152165882730681672033",
"49952343774444681656219903082815094522",
"61868131628201685269563423096647962558",
"161670517223910837382530657957095852523",
"248477742790931687131205110688474031531",
"19436218809657165732077551604601149373",
"312248434999038661245629875608081604147",
"265971394529959307766611349421679873819",
"306919543743493485939416952182694329518",
"21108996823097451612250932975543319500",
"141909479133156158154610619983404774577",
"259198806472612047787989298329892996695",
"149893436147211353806247266954036609582"
],
"threshold": 0.9
},
"id": "CVE-2026-77685-bafb5589",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/214530895dd327ef34468fb25e132df6976e927c",
"target": {
"file": "subsys/bluetooth/host/classic/rfcomm.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "120245288254565913647253510281458697802",
"length": 433
},
"id": "CVE-2026-77685-c6c1e61f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/214530895dd327ef34468fb25e132df6976e927c",
"target": {
"file": "subsys/bluetooth/host/classic/rfcomm.c",
"function": "rfcomm_send_rls"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "306340915651908414768859400854560922771",
"length": 355
},
"id": "CVE-2026-77685-c8ffdd7e",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/0040ef781e1d705066045850782cd8efa5beaa02",
"target": {
"file": "subsys/bluetooth/host/classic/rfcomm.c",
"function": "rfcomm_handle_rls"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "140519763987145995763773557346763317203",
"length": 1596
},
"id": "CVE-2026-77685-cadfaa4d",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/214530895dd327ef34468fb25e132df6976e927c",
"target": {
"file": "subsys/bluetooth/host/classic/rfcomm.c",
"function": "rfcomm_dlc_tx_worker"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "291993629123781155147724510143712667178",
"length": 255
},
"id": "CVE-2026-77685-ddbf181a",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/214530895dd327ef34468fb25e132df6976e927c",
"target": {
"file": "subsys/bluetooth/host/classic/rfcomm.c",
"function": "rfcomm_send_fcon"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "86924502606831741474358400003611016936",
"length": 1136
},
"id": "CVE-2026-77685-e820a9f1",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/214530895dd327ef34468fb25e132df6976e927c",
"target": {
"file": "subsys/bluetooth/host/classic/rfcomm.c",
"function": "rfcomm_handle_rpn"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "38796652897808894926971044981228619631",
"length": 256
},
"id": "CVE-2026-77685-e8f3c1bb",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/214530895dd327ef34468fb25e132df6976e927c",
"target": {
"file": "subsys/bluetooth/host/classic/rfcomm.c",
"function": "rfcomm_send_fcoff"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "75944068858568469869206973247869124179",
"length": 452
},
"id": "CVE-2026-77685-ebc618ab",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/214530895dd327ef34468fb25e132df6976e927c",
"target": {
"file": "subsys/bluetooth/host/classic/rfcomm.c",
"function": "rfcomm_handle_disc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"94742817788578325046201078070226653586",
"122337637571299354135927541606001368648",
"115418854533666070477041238769565458198",
"104261731447957859919494727626335701877",
"322393406012585493388893554086318480433",
"196143266195301869826990854846576981187",
"325766401307751182688571900026988321820",
"226230523139300167793958863784799390099",
"170245471592264396205003483486339080088",
"104861644610326441345660754384522016003",
"139642155624886369841122014918381686594",
"324854248226654675695461101928469681032",
"261722624653014817327177374900418836430",
"63187312574353524047274886086540842708",
"152874093995965895523939035538275120761",
"274156382318683288881806044699618173628",
"269269505152698326926189554164777203072",
"157616763290205389532534300541919293356",
"107839816734384682081318569842034205984",
"214757018325013906221827271801451599877",
"311901078448059286457828370295971575495",
"324190802815263520395832319480761515656",
"276024951717505918993300100872046574349",
"45061043577267687341795451843191508120",
"49234962281866262847551390641547719301",
"307636333472773909974269884232455111072",
"314372909750544833809224861538545452883",
"249855272298979296711708929703402618372",
"227959920669477414834645930014431209179",
"315854528138045936112777491804860524506",
"199519704961782571074815477850810291896",
"295617969347705664437699753547155244841",
"130211733695743981611922170638287626360",
"249422131398255096015344069163428145032",
"240828617857551583843833199893998590045",
"145618923264916537141572118606035634895",
"87679143994786077782838160649435380136",
"57659260510493055293847594909581744131",
"185613910568462425484679335178529697880",
"272831344077265697820673625966422200589",
"305339517508922771280488360789054271818",
"98401001389760426852668289792964668331",
"14108398626474104122402464550364540842",
"103815238639987284504739631031815615958",
"278268907296195400716823497220338502256",
"256791321089505265739068521819256214612",
"194434587581289529521245585344185696250",
"98620258673964579375034273754229427178",
"100459722728965167491559615389056640732",
"277820657702280714112971265841587599065",
"72419247352735801857391725316496473519",
"304150890524403260843829374188764957697",
"209181418596649079329723352376355153104",
"312404177837943853574444798499215509046",
"122486618252967717768084368911378122143",
"176967413238999487306550689860045266707",
"43427907790863669068336732546768024883",
"267532019503201041708884288341377915264",
"66862326592046886668928497699942943248",
"172568621787779552349341297540811782954",
"51256706465679948093439378964053730943",
"32352840998013767770037520936539582955",
"85828084262869619283229815033888471959",
"40973100371502124547395328120564720424",
"147827271653677569427722743752426965638",
"39727478095024417737223944414506335375",
"105347715939079962592425073604344045564",
"101327704507192158517414196303260814057",
"142798029406498882698621686259489698211",
"150323710736099105664433463030252951547",
"258683479742092736386578614063347843759",
"184623784195383582409945848923307127316",
"99842832813709204462311345271108114619",
"22337945791618933376689237208955359173",
"298903143091101772734233764674465881073",
"211932577157025848673359901445511641876",
"167934987052194309229393535129697679221",
"56046578093081311942569355776273931322",
"145510217317141103871318078581624164800",
"164383810704952444609162168488179016379"
],
"threshold": 0.9
},
"id": "CVE-2026-77685-ec5d6383",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/0040ef781e1d705066045850782cd8efa5beaa02",
"target": {
"file": "subsys/bluetooth/host/classic/rfcomm.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "158550029552616392750631939341554445889",
"length": 749
},
"id": "CVE-2026-77685-ecfac23c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/214530895dd327ef34468fb25e132df6976e927c",
"target": {
"file": "subsys/bluetooth/host/classic/rfcomm.c",
"function": "rfcomm_handle_msc"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "200277953402043145309222713369716644397",
"length": 623
},
"id": "CVE-2026-77685-eeeb020d",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/214530895dd327ef34468fb25e132df6976e927c",
"target": {
"file": "subsys/bluetooth/host/classic/rfcomm.c",
"function": "rfcomm_connected"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "175423592694152033071143256907402985404",
"length": 1326
},
"id": "CVE-2026-77685-ffd03045",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/214530895dd327ef34468fb25e132df6976e927c",
"target": {
"file": "subsys/bluetooth/host/classic/rfcomm.c",
"function": "rfcomm_handle_data"
}
}
]
vanir_signatures_modified
"2026-11-11T13:25:14Z"