This vulnerability arises from improper bounds checking in the Bluetooth host's L2CAP LE CoC SDU reassembly code (l2cap_chan_le_recv_seg). When segmentation is enabled via chan_ops.alloc_buf, and the RX buffer pool's user_data_size is less than 2 bytes, a 2-byte segmentation counter is written out of bounds in the net_buf user_data area. This out-of-bounds write can lead to heap corruption or fatal errors. The issue affects Zephyr RTOS version 1.14.0 and is exploitable by a remote, unauthenticated BLE peer.

An attacker with Bluetooth Low Energy access can cause memory corruption in the affected Zephyr Bluetooth host stack, potentially leading to application crashes or system instability. The CVSS score of 7.6 reflects high impact due to the possibility of denial of service or other integrity issues. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling segmentation or ensuring that the RX pool's user_data_size is at least 2 bytes to avoid triggering the out-of-bounds write. Monitor Zephyr project advisories for updates and patches addressing this vulnerability.