Read the docs
TI-2026-09181 Aliases CVE-2026-10680

Out-of-bounds access in Zephyr BR/EDR L2CAP configuration request handling via `uint16_t` length underflow

Priority LOW 34CWE-125Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

The Classic (BR/EDR) L2CAP signaling handlers l2cap_br_conf_req() and l2cap_br_conf_rsp() in subsys/bluetooth/host/classic/l2cap_br.c validated the minimum command size against buf->len (the bytes remaining in the whole received PDU) instead of len (the per-command data length from the L2CAP signaling header). Because multiple signaling commands can be packed into one PDU, buf->len may exceed a command's len. An attacker can send a CONF_REQ command with a header length smaller than the configuration-request structure (e.g. 0), followed by another command so that buf->len still satisfies the check. The check then passes incorrectly and opt_len = len - sizeof(*req) underflows the uint16_t to a near-0xFFFF value. The configuration-option loop, which lacks an opt_len-versus-buf->len guard, then walks far past the end of the pooled ACL receive buffer using net_buf pull primitives that perform no runtime bounds check, producing an out-of-bounds read of host memory and, when the out-of-bounds option bytes encode an MTU or flush-timeout option, an out-of-bounds write. The BR/EDR signaling channel is processed before pairing/encryption and an L2CAP channel to an L0 service such as SDP can be opened without pairing, so an unauthenticated peer within radio range that can establish an ACL connection can trigger the flaw, leading to memory corruption and denial of service (host/device crash). The defect is present in released versions including v4.4.0. The fix validates against len instead of buf->len in both handlers.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00161 5th percentileScored 2026-11-07
Fix Fixed zephyr (zephyrproject): 4.3.1, 4.4.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
zephyrprojectzephyr4.2.0 to before 4.3.1; 4.4.0 to before 4.4.24.3.1, 4.4.2Patch availableCNA
  • zephyr Vendorzephyrproject Affected 4.2.0 to before 4.3.1; 4.4.0 to before 4.4.2 Fixed in 4.3.1, 4.4.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:o:zephyrproject:zephyr:*:*:*:*:*:*:*:*4.2.0 to before 4.3.1; 4.4.0 – 4.4.1Vulnerablezephyrproject
  • cpe:2.3:o:zephyrproject:zephyr:*:*:*:*:*:*:*:* Versions 4.2.0 to before 4.3.1; 4.4.0 – 4.4.1 Vulnerable ·zephyrproject

Remediation

  • Fix · CNA zephyr (zephyrproject) Fixed in 4.3.1, 4.4.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    zephyrproject zephyr 4.3.1, 4.4.2

    5 records Highest priority Priority LOW 5 LOW

    Other records, highest priority first

    • TI-2026-09177 Bluetooth Mesh PB-ADV: invalidated provisioning link kept alive indefinitely, blocking (re)provisioning (DoS)Priority LOW 29
    • TI-2026-09178 Kernel heap memory leak in `z_vrfy_k_poll()` lets an unprivileged user thread exhaust the kernel resource poolPriority LOW 28
    • TI-2026-09180 Divide-by-zero in DesignWare SPI driver reachable from spi_transceive syscall (local DoS)Priority LOW 24
    Show all 5 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-10680
  2. 2026-10-16 Fix available: [email protected] · CNA

References

Patch 2

  • TI-2026-04422 Out-of-bounds read/write in HTTP WebSocket upgrade via non-null-terminated Sec-WebSocket-Key CVSS 3.1CRITICAL 9.8
  • TI-2026-01361 dns: memory‑safety issue in the DNS name parser CVSS 3.1CRITICAL 9.8
  • TI-2026-09174 Unterminated URI buffer causes out-of-bounds read in LwM2M firmware pull (Package URI) CVSS 3.1CRITICAL 9.1
  • TI-2026-09168 Stack buffer overflow in `net_ipaddr_parse()` IPv4 address-with-port parsing in `subsys/net/ip/utils.c` CVSS 3.1CRITICAL 9.8
  • TI-2024-09625 net: lib: http_server: Buffer Under-read CVSS 3.1HIGH 8.6
  • TI-2021-02863 Usb bluetooth device ACL read cb buffer overflow CVSS 3.1CRITICAL 9.6
See all 196 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences