CVE-2026-2411
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
A vulnerability in Zephyr's Bluetooth host causes incorrect permission checks when sending GATT notifications and indications. Passing the Characteristic Declaration attribute leads to checking declaration permissions instead of the characteristic value's security requirements, bypassing encryption or authentication.
Risk Assessment
An attacker can access protected sensitive data without the required link security level, resulting in information disclosure and access control bypass.
Recommendation
Update Zephyr immediately to a version containing the fix (bt_gatt_attr_resolve_value() function and corrected mask in the Notify-Multiple path).
Other vulnerabilities in Zephyr
See all- CVE-2026-10772Unknown
This CVE has been rejected as a duplicate. The described vulnerability involved incorrect permission checking in the Bluetooth GATT notify/indicate paths in the Zephyr stack, but was already reported as CVE-2026-2411.
- CVE-2026-10676Unknown
CVE-2026-10676 has been withdrawn as analysis determined that the reported defect is not reachable in any released version of Zephyr. In every supported release, the affected value is corrected before use.
- CVE-2026-5067Critical
Zephyr OS has a memory corruption vulnerability in the HTTP server WebSocket upgrade path. An unauthenticated remote attacker can trigger it by sending a crafted Sec-WebSocket-Key header. The bounded copy does not guarantee NUL termination, leading to out-of-bounds read/write on stack.
- CVE-2026-13735Low
Zephyr's WireGuard implementation mishandled keepalive packets. A type-4 message with a 16-byte payload (empty plaintext plus Poly1305 tag) was accepted without tag verification because wg_process_data_message() returned early before calling wg_decrypt_packet(). An attacker could send a forged keepalive without knowing the session key.
- CVE-2026-13734Medium
Vulnerability in Zephyr's WireGuard VPN: wg_process_data_message() validated the anti-replay counter too late, after committing peer-state changes (address update, timers, key rotation). An attacker can re-inject a captured packet, leading to endpoint hijacking and session disruption.
- CVE-2026-13212High
The Zephyr virtio driver does not validate the descriptor-chain head id written by the virtio device into the used ring. A malicious virtio backend can supply an out-of-range id, causing an out-of-bounds read and invocation of an attacker-controlled function pointer in the guest's interrupt context. This enables control-flow hijacking or a reliable crash.
- CVE-2026-12634Medium
A vulnerability in the NVS backend of the Zephyr settings subsystem (settings_nvs.c) causes an out-of-bounds stack write. The nvs_read() function returns the full entry length, which can exceed the buffer size, and the code uses this value as an index for writing a NUL character, leading to a write past the buffer (CWE-787).
- CVE-2026-12632Medium
A vulnerability in Zephyr RTOS's PTP receive handler allows a remote attacker to trigger an out-of-bounds read by sending a crafted PTP packet with an invalid message type (0xE or 0xF). The lack of an upper-bound check on the msg_size[] array index leads to reading beyond the array and subsequent memory operations, potentially causing a crash or limited memory corruption.
- CVE-2026-12630Medium
Zephyr's 6LoWPAN IPHC uncompression code contains an out-of-bounds read in get_ihpc_inlined_size() (subsys/net/ip/6lo.c). The destination inline size is looked up in da_inline_size_table (13 entries) using an index built from the M, DAC and DAM bits of the IPHC dispatch word; reserved combinations 13, 14 and 15 are not bounds-checked and read past the end of the table.
- CVE-2026-12366High
A use-after-free vulnerability exists in Zephyr's dynamic kernel-object disposal path. The unref_check() function frees object storage when the reference count reaches zero, but for timers (K_OBJ_TIMER) it does not cancel the active timeout, leaving a dangling node in the global timeout queue. When the timer expires, the kernel invokes the expiration handler on freed memory, causing a write to freed heap.
Original NVD description (English source)
Zephyr's Bluetooth host declares a GATT characteristic as two consecutive attributes: a Characteristic Declaration whose permission is hard-coded to BT_GATT_PERM_READ, and a Characteristic Value attribute that carries the application-specified security permissions (e.g. BT_GATT_PERM_READ_ENCRYPT / READ_AUTHEN / READ_LESC). The public notify and indicate APIs explicitly accept either attribute, and passing the declaration is the documented, common idiom. Before sending each notification or indication, the host re-checks link security with bt_gatt_check_perm() against params->attr in gatt_notify(), gatt_indicate(), and gatt_notify_multiple_verify_params() (subsys/bluetooth/host/gatt.c). When the application passed the Characteristic Declaration attribute, the host correctly redirected the value handle but left params->attr pointing at the declaration, so the security check evaluated the declaration's permissions (no security required) instead of the value's. As a result the encryption/authentication/LESC requirement configured on the characteristic value was skipped. The Notify-Multiple path additionally used a mask that omitted the LE Secure Connections requirement. A remote peer triggers the disclosure by connecting (optionally without pairing or encryption) and writing the Client Characteristic Configuration descriptor to enable notifications or indications, causing the server to emit the protected value over a link that has not reached the required security level. The impact is information disclosure / access-control bypass for characteristic values the application intended to expose only over a secured link; exposure depends on the application declaring encrypt/authen-required notify/indicate characteristics and on the CCC being writable at a lower security tier. There is no memory-safety or availability impact. The fix adds bt_gatt_attr_resolve_value(), which maps a declaration attribute to the following value attribute before the permission check, and switches the Notify-Multiple path to the full BT_GATT_PERM_READ_ENCRYPT_MASK so the LESC requirement is also enforced.