PT-2026-62127 · Zephyr · Zephyr
CVE-2026-10680
·
Published
2026-07-21
·
Updated
2026-07-21
CVSS v3.1
7.6
High
| Vector | AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H |
Name of the Vulnerable Software and Affected Versions
Zephyr versions 4.4.0 and earlier
Description
An issue exists in the Classic (BR/EDR) L2CAP signaling handlers
l2cap br conf req() and l2cap br conf rsp() within subsys/bluetooth/host/classic/l2cap br.c. The handlers incorrectly validate the minimum command size against buf->len (the total bytes remaining in the received PDU) instead of len (the specific data length for the command from the L2CAP signaling header). Since multiple commands can be packed into one PDU, an attacker can send a CONF REQ command with a header length smaller than the configuration-request structure, causing opt len to underflow to a large value. This allows the configuration-option loop to read host memory out-of-bounds and potentially perform an out-of-bounds write if the bytes encode an MTU or flush-timeout option. Because the BR/EDR signaling channel is processed before pairing or encryption, an unauthenticated peer within radio range can trigger this flaw, resulting in memory corruption and denial of service.Recommendations
Update to a version where the
l2cap br conf req() and l2cap br conf rsp() handlers validate against len instead of buf->len.Exploit
Fix
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Zephyr