# CVE-2026-2411: Zephyr's Bluetooth host declares a GATT characteristic as two consecutive attributes: a Characteristic Declaration…

Source: https://junglewise.ai/threats/cve-2026-2411-zephyr-s-bluetooth-host-declares-a-gatt-characteristic-as-two  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-01  
License: CC BY 4.0 with a link back

CVE-2026-2411 · Severity: medium · CVSS 6.5 · Published 2026-08-01

Zephyr's Bluetooth host declares a GATT characteristic as two consecutive attributes: a Characteristic Declaration whose permission is hard-coded to BT_GATT_PERM_READ, and a Characteristic Value attribute that carries the application-specified security permissions (e.g. BT_GATT_PERM_READ_ENCRYPT / READ_AUTHEN / READ_LESC). The public notify and indicate APIs explicitly accept either attribute, and passing the declaration is the documented, common idiom. Before sending each notification or indication, the host re-checks link security with bt_gatt_check_perm() against params->attr in gatt_notify(), gatt_indicate(), and gatt_notify_multiple_verify_params() (subsys/bluetooth/host/gatt.c).

When the application passed the Characteristic Declaration attribute, the host correctly redirected the value handle but left params->attr pointing at the declaration, so the security check evaluated the declaration's permissions (no security required) instead of the value's. As a result the encryption/authentication/LESC requirement configured on the characteristic value was skipped. The Notify-Multiple path additionally used a mask that omitted the LE Secure Connections requirement.

A remote peer triggers the disclosure by connecting (optionally without pairing or encryption) and writing the Client Characteristic Configuration descriptor to enable notifications or indications, causing the server to emit the protected value over a link that has not reached the required security level. The impact is information disclosure / access-control bypass for characteristic values the application intended to expose only over a secured link; exposure depends on the application declaring encrypt/authen-required notify/indicate characteristics and on the CCC being writable at a lower security tier. There is no memory-safety or availability impact.

The fix adds bt_gatt_attr_resolve_value(), which maps a declaration attribute to the following value attribute before the permission check, and switches the Notify-Multiple path to the full BT_GATT_PERM_READ_ENCRYPT_MASK so the LESC requirement is also enforced.

Technologies: [Zephyrproject Zephyr](https://junglewise.ai/threats/technologies/zephyrproject-zephyr). Vendors: [Zephyrproject](https://junglewise.ai/threats/vendors/zephyrproject).

## Quick answers

**Is CVE-2026-2411 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-2411 being exploited in the wild.

**How severe is CVE-2026-2411?** Medium severity, with a CVSS score of 6.5, published 1 August 2026.

**Which products and versions are affected?** Zephyrproject Zephyr. The advisory does not name versions.

**Is there a fix for CVE-2026-2411?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2026-2411?** Check whether you run Zephyrproject Zephyr. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Zephyrproject Zephyr

## Related threats

- [The Bluetooth host ATT layer (subsys/bluetooth/host/att.c) associates each in-flight ATT TX buffer with its owning…](https://junglewise.ai/threats/cve-2026-11368-the-bluetooth-host-att-layer-subsys-bluetooth-host-att-c)
- [The hawkBit device management client in subsys/mgmt/hawkbit accumulates the body of an HTTP response from the update…](https://junglewise.ai/threats/cve-2026-10849-the-hawkbit-device-management-client-in-subsys-mgmt-hawkbit)
- [The DHCPv4 client helper net_dhcpv4_msg_type_name() in subsys/net/lib/dhcpv4/dhcpv4.c indexes a static 8-element const…](https://junglewise.ai/threats/cve-2026-10773-the-dhcpv4-client-helper-net-dhcpv4-msg-type-name-in-subsys-net)
- [The eswifi socket offload driver copies user-provided payloads into a fixed buffer without checking available space…](https://junglewise.ai/threats/cve-2026-1679-the-eswifi-socket-offload-driver-copies-user-provided-payloads)
- [dns_unpack_name() caches the buffer tailroom once and reuses it while appending DNS labels. As the buffer grows, the…](https://junglewise.ai/threats/cve-2026-1678-dns-unpack-name-caches-the-buffer-tailroom-once-and-reuses-it)