Executive brief
A vulnerability exists in the Bluetooth software of the Zephyr operating system, which is commonly used in embedded and IoT devices. A nearby attacker can send specially crafted Bluetooth signals to cause the device to crash or malfunction. This could lead to a complete service outage or allow an attacker to corrupt the device's memory, potentially impacting its reliability and security.
Technical details
An out-of-bounds (OOB) write vulnerability exists in the Zephyr Bluetooth host within the L2CAP LE Credit Based Flow Control (CoC) SDU reassembly logic. The flaw is located in `l2cap_chan_le_recv_seg` in `subsys/bluetooth/host/l2cap.c`. When an application enables segmentation via `chan_ops.alloc_buf` and the RX pool's `user_data_size` is configured to be smaller than 2 bytes, the segmentation counter is written past the allocated buffer. An unauthenticated attacker within Bluetooth range (adjacent) can exploit this to cause heap corruption, a fatal error, or an AddressSanitizer abort. Patches have been developed for the main branch and version 4.3.
Affected products
- Zephyr Project Zephyr OS <= 4.4.0
Timeline
- 2026-05-21: other: Embargo date
- 2026-06-09: disclosed: Initial disclosure and NVD publication