CVE-2026-10680

Analyzed Analyzed - Analysis Complete

Bluetooth Classic L2CAP Out-of-Bounds Read in Zephyr RTOS

Publication date: 2026-07-21

Last updated on: 2026-07-30

Assigner: Zephyr Project

Description

The Classic (BR/EDR) L2CAP signaling handlers l2cap_br_conf_req() and l2cap_br_conf_rsp() in subsys/bluetooth/host/classic/l2cap_br.c validated the minimum command size against buf->len (the bytes remaining in the whole received PDU) instead of len (the per-command data length from the L2CAP signaling header). Because multiple signaling commands can be packed into one PDU, buf->len may exceed a command's len. An attacker can send a CONF_REQ command with a header length smaller than the configuration-request structure (e.g. 0), followed by another command so that buf->len still satisfies the check. The check then passes incorrectly and opt_len = len - sizeof(*req) underflows the uint16_t to a near-0xFFFF value. The configuration-option loop, which lacks an opt_len-versus-buf->len guard, then walks far past the end of the pooled ACL receive buffer using net_buf pull primitives that perform no runtime bounds check, producing an out-of-bounds read of host memory and, when the out-of-bounds option bytes encode an MTU or flush-timeout option, an out-of-bounds write. The BR/EDR signaling channel is processed before pairing/encryption and an L2CAP channel to an L0 service such as SDP can be opened without pairing, so an unauthenticated peer within radio range that can establish an ACL connection can trigger the flaw, leading to memory corruption and denial of service (host/device crash). The defect is present in released versions including v4.4.0. The fix validates against len instead of buf->len in both handlers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-30

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-10680

Affected Vendors & Products

Vendor	Product	Version / Range
zephyrproject	zephyr	From 4.4.0 (inc) to 4.4.1 (inc)
zephyrproject	zephyr	From 4.2.0 (inc) to 4.3.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability involves incorrect validation in Bluetooth Classic L2CAP signaling handlers. The functions l2cap_br_conf_req() and l2cap_br_conf_rsp() check the minimum command size against the wrong buffer length, allowing an attacker to craft a malicious packet that bypasses checks. This leads to an underflow in a length variable, causing the system to read or write outside the intended memory buffer, resulting in memory corruption and potential device crashes.

Detection Guidance

Detection requires monitoring for malformed L2CAP signaling packets. Use Bluetooth sniffing tools like hcidump or btmon to capture and analyze L2CAP traffic for unusually small CONF_REQ commands followed by additional commands in the same PDU. Check for crashes or memory corruption in Bluetooth host logs after suspicious traffic is observed.

Impact Analysis

An attacker within Bluetooth range could exploit this flaw to crash your device by sending a malformed packet. This could disrupt Bluetooth functionality, cause system instability, or potentially allow unauthorized access if paired with other vulnerabilities. Devices using vulnerable versions of the Zephyr RTOS Bluetooth stack are affected.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized memory access and denial of service on affected devices. Unauthenticated attackers within radio range could exploit the flaw to crash devices or corrupt memory, which may lead to unauthorized data access or processing disruptions. Such incidents could violate data protection requirements under GDPR (e.g., integrity and confidentiality of personal data) and HIPAA (e.g., availability and security of protected health information).

Mitigation Strategies

Apply the vendor patch that validates against len instead of buf->len in l2cap_br_conf_req() and l2cap_br_conf_rsp(). Disable BR/EDR if not needed. Restrict Bluetooth access to trusted devices only. Monitor for crashes or unusual activity on Bluetooth services.

Hi! I’m here to help you understand CVE-2026-10680. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70