Executive brief
Zephyr RTOS, a popular operating system for embedded and IoT devices, contains a vulnerability in its Bluetooth Classic (BR/EDR) communication stack. An attacker within radio range can send specially crafted Bluetooth signals to trigger memory corruption or a system crash. This could lead to a denial of service or potentially allow unauthorized access to sensitive data on the device, even if the device has not been paired with the attacker's hardware.
Technical details
A vulnerability exists in the L2CAP signaling handlers `l2cap_br_conf_req()` and `l2cap_br_conf_rsp()` within `subsys/bluetooth/host/classic/l2cap_br.c`. The handlers incorrectly validate the minimum command size against the total remaining PDU buffer length (`buf->len`) instead of the specific command length (`len`) provided in the signaling header. By packing multiple commands into a single PDU, an attacker can provide a command length smaller than the required structure size, causing a `uint16_t` underflow when calculating `opt_len`. This leads to an out-of-bounds read/write as the configuration-option loop processes memory past the end of the receive buffer. The flaw is exploitable by an unauthenticated peer within radio range before pairing is established. Fixes are available in Zephyr versions 4.3.1 and 4.5.0.
Affected products
- Zephyr Project Zephyr RTOS >= 4.2.0, < 4.3.1; >= 4.4.0, <= 4.4.1
Timeline
- 2026-07-21: advisory: GHSA-vrwx-p97q-8854 published
- 2026-07-21: disclosed: CVE-2026-10680 published