What’s Vulnerable › Vulnerabilities
CVE-2026-5068: bt: l2cap le coc: remote oob write via seg counter stored in net_buf user_data
- Severity: high (CVSS 8.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2026-06-09 · updated 2026-10-15
- Weakness: CWE-787
Description
A remote, unauthenticated BLE peer can trigger a 2-byte out-of-bounds write in the Bluetooth host during L2CAP LE CoC SDU reassembly. When the application enables segmentation (via chan_ops.alloc_buf) and the chosen RX pool has a user_data_size smaller than 2 bytes, the segmentation counter stored in the net_buf user_data area is written out of bounds in l2cap_chan_le_recv_seg (subsys/bluetooth/host/l2cap.c). The observed effects are an AddressSanitizer abort and, without ASan, heap corruption / fatal error.
Affected products
- zephyrproject zephyr: through 4.4.0
References
Get alerted when CVE-2026-5068 or the next vulnerability affects your stack