Description
The Bluetooth host ATT layer (subsys/bluetooth/host/att.c) associates each in-flight ATT TX buffer with its owning channel via the static tx_meta_data_storage[] array (data->att_chan = chan). When a buffer's last reference is dropped, its net-buf destroy callback defers the completion handling to the system workqueue (att_tx_destroy -> att_tx_destroy_work_handler -> att_on_sent_cb -> bt_att_sent), where bt_att_sent dereferences the channel and its ATT context (sys_slist_get(&att->reqs)).

When a peer disconnects while an ATT PDU (a server notification/indication or any response) is still in flight in the controller TX path, L2CAP tears the channel down in l2cap_chan_del(): it runs the disconnected callback and then the released callback (bt_att_released), which frees the channel slab slot. Because the in-flight buffer is held by the connection TX path rather than the channel's own queue, its deferred destroy work can run after the channel has been freed. The att_on_sent_cb guard intended to drop the stale callback itself dereferences meta->att_chan, which is now a dangling pointer into a freed (and possibly reused) slab slot.

A remote peer with an ATT connection can drive this by disconnecting during routine ATT traffic; no pairing or user interaction is required to reach the ATT bearer. The result is a use-after-free read/write of freed channel memory, reliably crashing the Bluetooth host (denial of service) and, because the channel slab slot may be reused, potentially corrupting live memory.

The fix makes bt_att_released() NULL the att_chan field of every tx_meta_data_storage[] entry still referencing the channel before freeing it, so the deferred guard observes a NULL pointer and drops the callback. Teardown and the destroy work both run on the cooperative system workqueue, so the array update is serialized and needs no lock.
Published: 2026-08-04
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A use‑after‑free flaw exists in the Bluetooth host ATT layer of Zephyr. When a peer disconnects while an ATT packet is still in flight, the channel is freed before the deferred send‑completion callback runs. The callback then dereferences a dangling pointer, causing the host to crash or corrupt memory, which provides a remote denial‑of‑service and potential impact on data integrity. The weakness is a classic use‑after‑free flaw categorized as CWE‑416.

Affected Systems

The vulnerability affects devices running Zephyr RTOS that include the buggy Bluetooth stack before the commit dfdea9bad8d9b5b31c125e97fcffb549f2217caa. This encompasses any Zephyr release that has not yet applied the fix, so all builds using the standard Bluetooth host ATT implementation are potentially impacted.

Risk and Exploitability

The CVSS score is 7.1, indicating a moderate severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. An attacker only needs a remote Bluetooth connection and can trigger the flaw by simply disconnecting during normal ATT traffic; no pairing or privileged access is required. The resulting crash or memory corruption can be used to disrupt function or, if the freed slab slot is reused, to influence live memory. The exploit is straightforward once connectivity is established, making the risk significant for exposed devices.

Generated by OpenCVE AI on August 4, 2026 at 20:13 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Zephyr patch or backport the bug fix
  • Configure the device to accept ATT connections only from trusted peers, rejecting or ignoring traffic from unknown devices until the patch is deployed
  • If the device cannot be updated immediately, disable the Bluetooth Host service or reduce Bluetooth functionality to a minimal set

Generated by OpenCVE AI on August 4, 2026 at 20:13 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 04 Aug 2026 17:15:00 +0000

Type Values Removed Values Added
First Time appeared Zephyrproject
Zephyrproject zephyr
Vendors & Products Zephyrproject
Zephyrproject zephyr

Tue, 04 Aug 2026 15:00:00 +0000

Type Values Removed Values Added
Description The Bluetooth host ATT layer (subsys/bluetooth/host/att.c) associates each in-flight ATT TX buffer with its owning channel via the static tx_meta_data_storage[] array (data->att_chan = chan). When a buffer's last reference is dropped, its net-buf destroy callback defers the completion handling to the system workqueue (att_tx_destroy -> att_tx_destroy_work_handler -> att_on_sent_cb -> bt_att_sent), where bt_att_sent dereferences the channel and its ATT context (sys_slist_get(&att->reqs)). When a peer disconnects while an ATT PDU (a server notification/indication or any response) is still in flight in the controller TX path, L2CAP tears the channel down in l2cap_chan_del(): it runs the disconnected callback and then the released callback (bt_att_released), which frees the channel slab slot. Because the in-flight buffer is held by the connection TX path rather than the channel's own queue, its deferred destroy work can run after the channel has been freed. The att_on_sent_cb guard intended to drop the stale callback itself dereferences meta->att_chan, which is now a dangling pointer into a freed (and possibly reused) slab slot. A remote peer with an ATT connection can drive this by disconnecting during routine ATT traffic; no pairing or user interaction is required to reach the ATT bearer. The result is a use-after-free read/write of freed channel memory, reliably crashing the Bluetooth host (denial of service) and, because the channel slab slot may be reused, potentially corrupting live memory. The fix makes bt_att_released() NULL the att_chan field of every tx_meta_data_storage[] entry still referencing the channel before freeing it, so the deferred guard observes a NULL pointer and drops the callback. Teardown and the destroy work both run on the cooperative system workqueue, so the array update is serialized and needs no lock.
Title Use-after-free in Bluetooth host ATT TX completion on disconnect mid-transfer
Weaknesses CWE-416
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H'}

Subscriptions

Zephyrproject Zephyr
cve-icon MITRE

Status: PUBLISHED

Assigner: zephyr

Published:

Updated: 2026-08-04T17:57:40.823Z

Reserved: 2026-06-05T12:00:57.310Z

Link: CVE-2026-11368

cve-icon Vulnrichment

Updated: 2026-08-04T17:57:02.106Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-04T15:16:24.843

Modified: 2026-08-09T14:26:15.890

Link: CVE-2026-11368

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T20:15:12Z

Weaknesses