CVE-2026-15460VulnerabilityPublished 09/09/2026

CVE-2026-15460: logic in zephyrproject zephyr

Affects zephyrproject zephyrSource CVE Database V5

Not known to be exploited · CVSS 5.4 Medium.

Data as of 10/25/2026, 04:40:11 UTC

CVSS 3.1 base score

5.4Medium

How severe the flaw is on the 0–10 CVSS scale.

Exploitation: Not in CISA KEV, no exploitation reported
EPSS: 0.1% chance of exploitation in 30 days – higher than 4% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Attack Vector: Adjacent
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: Low
Availability: Low

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Adjacent: The vulnerable component is bound to the network stack, but the attack is limited at the protocol level to a logically adjacent topology. This can mean an attack must be launched from the same shared physical (e.g., Bluetooth or IEEE 802.11) or logical (e.g., local IP subnet) network, or from within a secure or otherwise limited administrative domain (e.g., MPLS, secure VPN to an administrative network zone).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: None: There is no loss of confidentiality within the impacted component.
Integrity: Low: Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is limited. The data modification does not have a direct, serious impact on the impacted component.
Availability: Low: Performance is reduced or there are interruptions in resource availability. Even if repeated exploitation of the vulnerability is possible, the attacker does not have the ability to completely deny service to legitimate users. The resources in the impacted component are either partially available all of the time, or fully available only some of the time, but overall there is no direct, serious consequence to the impacted component.

Definitions: FIRST CVSS v3.1 specification.

What to do

Affected software

Product	Affected	Fixed in
zephyrprojectzephyr	Affected >=1.6.0 <4.4.2	Fixed in 4.4.2
GitHubzephyr`pkg:github/zephyr`Other threats	Affected >=1.6.0 <4.4.2	Fixed in 4.4.2

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

The described fix adds a state check to ensure data is only processed on fully connected channels. Until an official fix is confirmed, avoid exposure to untrusted Bluetooth Classic peers or disable Bluetooth Classic L2CAP if feasible.

Description

CVE-2026-15460 is a medium severity vulnerability in the Zephyr project's Bluetooth Classic L2CAP receive handler. The flaw allows a remote attacker within radio range to send data to a channel that is not fully connected or authenticated, potentially causing denial of service or a dangling pointer condition. This occurs because inbound data PDUs are dispatched based only on the destination channel ID without verifying the channel's connected state. The issue affects Zephyr versions from 1.6.0 up to but not including 4.4.2. The vulnerability does not impact confidentiality but can affect integrity and availability.

Impact

An attacker within radio range can send crafted data PDUs to a Bluetooth channel that is not fully connected or authenticated, causing the system to process attacker data on a half-open channel. This can lead to denial of service through channel or link teardown and potentially trigger a dangling pointer condition due to stale channel state. There is no impact on confidentiality, but integrity and availability are affected.

Summary

The vulnerability exists in the Bluetooth Classic (BR/EDR) L2CAP receive handler function bt_l2cap_br_recv() in Zephyr. It dispatches inbound data PDUs based solely on the destination channel ID without confirming that the channel has reached the BT_L2CAP_CONNECTED state. Since dynamic channels are assigned RX CIDs and added to the connection's channel list while still in the BT_L2CAP_CONNECTING or BT_L2CAP_CONFIG states, a remote attacker can send data PDUs to a not-yet-established channel. The channel's state fields used for dispatching may be stale due to reuse of channel objects without proper reset, leading to processing of attacker data on half-open or unauthenticated channels. This can cause channel or link teardown (denial of service) and dangling pointer conditions. The fix involves adding a guard to drop data received before the channel is fully connected.

References

Community reviews

Loading reviews…