CVE-2026-10680: bounds in zephyrproject zephyr
The Classic (BR/EDR) L2CAP signaling handlers l2cap_br_conf_req() and l2cap_br_conf_rsp() in subsys/bluetooth/host/classic/l2cap_br.c validated the minimum command size against buf->len (the bytes remaining in the whole received PDU) instead of len (the per-command data length from the L2CAP signaling header). Because multiple signaling commands can be packed into one PDU, buf->len may exceed a command's len. An attacker can send a CONF_REQ command with a header length smaller than the configuration-request structure (e.g. 0), followed by another command so that buf->len still satisfies the check. The check then passes incorrectly and opt_len = len - sizeof(*req) underflows the uint16_t to a near-0xFFFF value. The configuration-option loop, which lacks an opt_len-versus-buf->len guard, then walks far past the end of the pooled ACL receive buffer using net_buf pull primitives that perform no runtime bounds check, producing an out-of-bounds read of host memory and, when the out-of-bounds option bytes encode an MTU or flush-timeout option, an out-of-bounds write. The BR/EDR signaling channel is processed before pairing/encryption and an L2CAP channel to an L0 service such as SDP can be opened without pairing, so an unauthenticated peer within radio range that can establish an ACL connection can trigger the flaw, leading to memory corruption and denial of service (host/device crash). The defect is present in released versions including v4.4.0. The fix validates against len instead of buf->len in both handlers.
AI Analysis
Technical Summary
The Classic (BR/EDR) L2CAP signaling handlers l2cap_br_conf_req() and l2cap_br_conf_rsp() in Zephyr validate the minimum command size against the total PDU length (buf->len) rather than the per-command length (len). Since multiple commands can be packed into one PDU, this allows an attacker to craft a CONF_REQ command with a header length smaller than expected, causing an underflow in the calculation of option length (opt_len). This underflow leads to out-of-bounds reads and writes in the pooled ACL receive buffer, resulting in memory corruption and denial of service. The vulnerability can be triggered by an unauthenticated attacker within radio range who can establish an ACL connection, as the BR/EDR signaling channel is processed before pairing or encryption. The defect is present in released versions including 4.2.0 and 4.4.0. The fix involves validating against the per-command length instead of the total buffer length.
Potential Impact
An unauthenticated attacker within radio range can exploit this vulnerability to cause out-of-bounds memory reads and writes, leading to memory corruption and denial of service (host or device crash). The flaw affects the Bluetooth Classic L2CAP signaling channel before pairing or encryption, allowing exploitation without authentication. Confidentiality and integrity impacts are rated low, but availability impact is high.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The fix involves correcting the validation logic in the affected handlers to use the per-command length rather than the total buffer length. Until a patch is available, restrict Bluetooth Classic BR/EDR access to trusted devices and minimize exposure to unauthenticated peers within radio range.
CVE-2026-10680: bounds in zephyrproject zephyr
Description
The Classic (BR/EDR) L2CAP signaling handlers l2cap_br_conf_req() and l2cap_br_conf_rsp() in subsys/bluetooth/host/classic/l2cap_br.c validated the minimum command size against buf->len (the bytes remaining in the whole received PDU) instead of len (the per-command data length from the L2CAP signaling header). Because multiple signaling commands can be packed into one PDU, buf->len may exceed a command's len. An attacker can send a CONF_REQ command with a header length smaller than the configuration-request structure (e.g. 0), followed by another command so that buf->len still satisfies the check. The check then passes incorrectly and opt_len = len - sizeof(*req) underflows the uint16_t to a near-0xFFFF value. The configuration-option loop, which lacks an opt_len-versus-buf->len guard, then walks far past the end of the pooled ACL receive buffer using net_buf pull primitives that perform no runtime bounds check, producing an out-of-bounds read of host memory and, when the out-of-bounds option bytes encode an MTU or flush-timeout option, an out-of-bounds write. The BR/EDR signaling channel is processed before pairing/encryption and an L2CAP channel to an L0 service such as SDP can be opened without pairing, so an unauthenticated peer within radio range that can establish an ACL connection can trigger the flaw, leading to memory corruption and denial of service (host/device crash). The defect is present in released versions including v4.4.0. The fix validates against len instead of buf->len in both handlers.
CVSS v3.1
Score 7.6high
Affected software
pkg:github/zephyrRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Classic (BR/EDR) L2CAP signaling handlers l2cap_br_conf_req() and l2cap_br_conf_rsp() in Zephyr validate the minimum command size against the total PDU length (buf->len) rather than the per-command length (len). Since multiple commands can be packed into one PDU, this allows an attacker to craft a CONF_REQ command with a header length smaller than expected, causing an underflow in the calculation of option length (opt_len). This underflow leads to out-of-bounds reads and writes in the pooled ACL receive buffer, resulting in memory corruption and denial of service. The vulnerability can be triggered by an unauthenticated attacker within radio range who can establish an ACL connection, as the BR/EDR signaling channel is processed before pairing or encryption. The defect is present in released versions including 4.2.0 and 4.4.0. The fix involves validating against the per-command length instead of the total buffer length.
Potential Impact
An unauthenticated attacker within radio range can exploit this vulnerability to cause out-of-bounds memory reads and writes, leading to memory corruption and denial of service (host or device crash). The flaw affects the Bluetooth Classic L2CAP signaling channel before pairing or encryption, allowing exploitation without authentication. Confidentiality and integrity impacts are rated low, but availability impact is high.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The fix involves correcting the validation logic in the affected handlers to use the per-command length rather than the total buffer length. Until a patch is available, restrict Bluetooth Classic BR/EDR access to trusted devices and minimize exposure to unauthenticated peers within radio range.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- zephyr
- Date Reserved
- 2026-06-02T15:26:10.782Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a5fe6ba9c2644c7f8cb00d1
Added to database: 07/21/2026, 21:38:02 UTC
Last enriched: 07/22/2026, 10:07:07 UTC
Last updated: 07/31/2026, 19:22:57 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.