# CVE-2026-11368: The Bluetooth host ATT layer (subsys/bluetooth/host/att.c) associates each in-flight ATT TX buffer with its owning…

Source: https://junglewise.ai/threats/cve-2026-11368-the-bluetooth-host-att-layer-subsys-bluetooth-host-att-c  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-04  
License: CC BY 4.0 with a link back

CVE-2026-11368 · Severity: high · CVSS 7.1 · Published 2026-08-04

The Bluetooth host ATT layer (subsys/bluetooth/host/att.c) associates each in-flight ATT TX buffer with its owning channel via the static tx_meta_data_storage[] array (data->att_chan = chan). When a buffer's last reference is dropped, its net-buf destroy callback defers the completion handling to the system workqueue (att_tx_destroy -> att_tx_destroy_work_handler -> att_on_sent_cb -> bt_att_sent), where bt_att_sent dereferences the channel and its ATT context (sys_slist_get(&att->reqs)).

When a peer disconnects while an ATT PDU (a server notification/indication or any response) is still in flight in the controller TX path, L2CAP tears the channel down in l2cap_chan_del(): it runs the disconnected callback and then the released callback (bt_att_released), which frees the channel slab slot. Because the in-flight buffer is held by the connection TX path rather than the channel's own queue, its deferred destroy work can run after the channel has been freed. The att_on_sent_cb guard intended to drop the stale callback itself dereferences meta->att_chan, which is now a dangling pointer into a freed (and possibly reused) slab slot.

A remote peer with an ATT connection can drive this by disconnecting during routine ATT traffic; no pairing or user interaction is required to reach the ATT bearer. The result is a use-after-free read/write of freed channel memory, reliably crashing the Bluetooth host (denial of service) and, because the channel slab slot may be reused, potentially corrupting live memory.

The fix makes bt_att_released() NULL the att_chan field of every tx_meta_data_storage[] entry still referencing the channel before freeing it, so the deferred guard observes a NULL pointer and drops the callback. Teardown and the destroy work both run on the cooperative system workqueue, so the array update is serialized and needs no lock.

Technologies: [Zephyrproject Zephyr](https://junglewise.ai/threats/technologies/zephyrproject-zephyr). Vendors: [Zephyrproject](https://junglewise.ai/threats/vendors/zephyrproject).

## Quick answers

**Is CVE-2026-11368 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-11368 being exploited in the wild.

**How severe is CVE-2026-11368?** High severity, with a CVSS score of 7.1, published 4 August 2026.

**Which products and versions are affected?** Zephyrproject Zephyr. The advisory does not name versions.

**Is there a fix for CVE-2026-11368?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2026-11368?** Check whether you run Zephyrproject Zephyr. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Zephyrproject Zephyr

## Related threats

- [The hawkBit device management client in subsys/mgmt/hawkbit accumulates the body of an HTTP response from the update…](https://junglewise.ai/threats/cve-2026-10849-the-hawkbit-device-management-client-in-subsys-mgmt-hawkbit)
- [Zephyr's Bluetooth host declares a GATT characteristic as two consecutive attributes: a Characteristic Declaration…](https://junglewise.ai/threats/cve-2026-2411-zephyr-s-bluetooth-host-declares-a-gatt-characteristic-as-two)
- [The DHCPv4 client helper net_dhcpv4_msg_type_name() in subsys/net/lib/dhcpv4/dhcpv4.c indexes a static 8-element const…](https://junglewise.ai/threats/cve-2026-10773-the-dhcpv4-client-helper-net-dhcpv4-msg-type-name-in-subsys-net)
- [The eswifi socket offload driver copies user-provided payloads into a fixed buffer without checking available space…](https://junglewise.ai/threats/cve-2026-1679-the-eswifi-socket-offload-driver-copies-user-provided-payloads)
- [dns_unpack_name() caches the buffer tailroom once and reuses it while appending DNS labels. As the buffer grows, the…](https://junglewise.ai/threats/cve-2026-1678-dns-unpack-name-caches-the-buffer-tailroom-once-and-reuses-it)