7.6high
bt: l2cap le coc: remote oob write via seg counter stored in net_buf user_data
Fixed in: main PR #104913, v4.3 PR #108335; v3.7 backport pending
patched
details
- Finding IDs
- F-ZEPHYR-BLE-001
- CVE
- CVE-2026-5068
- GHSA
- GHSA-qrcq-hxwj-mqxm
- Status
- patched
- CWE
- CWE-787
- Fixed in
- main PR #104913, v4.3 PR #108335; v3.7 backport pending
- Recorded credit
- reporter: @1seal
- Note
- GHSA-qrcq-hxwj-mqxm · bt l2cap le coc remote out-of-bounds write via segment counter stored in net_buf user_data. advisory credits @1seal as reporter; main PR #104913 merged 2026-03-28 and v4.3 backport PR #108335 merged 2026-06-03; v3.7 backport #108336 remained pending at verification time and the advisory listed patched versions as none.
- CVSS vector
- CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
- CVE registry state
- PUBLISHED
- CVE state checked
- CVSS assessment
- Zephyr (repository advisory); v3.1; 7.6; observed 2026-09-24
- Upstream title
- bt: l2cap le coc: remote oob write via seg counter stored in net_buf user_data
- Upstream CWE
- CWE-787
- Upstream publication
- Upstream updated
- Metadata fetched
- Upstream @1seal credit
- @1seal: reporter (accepted)
F-ZEPHYR-BLE-001: Memory safety. The recorded BLE issue involves an out-of-bounds memory access. Reviewed 24 Sep 2026. Mechanism assessed by 1seal.
Mechanism source for F-ZEPHYR-BLE-001
Security area (1seal assessment): Memory safety. BLE L2CAP reassembly writes a two-byte segment counter beyond undersized buffer user data. Reviewed 21 Sep 2026.