CVE-2026-10772 Overview
CVE-2026-10772 is a rejected CVE record. The Zephyr Project CNA rejected this identifier as a duplicate of CVE-2026-2411, which was assigned earlier for the same underlying defect in the Zephyr RTOS Bluetooth stack. Both records describe the same root cause in subsys/bluetooth/host/gatt.c, where the Bluetooth GATT notify and indicate paths check permissions on the Characteristic Declaration attribute instead of the Characteristic Value attribute. The consequence is that encryption and authentication requirements configured on the value attribute are not enforced. Both identifiers reference the same fix commit c3386f92fe81bd10dc23e6a115e6a80a7d863546. Consumers should track CVE-2026-2411 for authoritative status, scoring, and remediation guidance.
Critical Impact
No action is required for CVE-2026-10772 itself. Refer to CVE-2026-2411 for the substantive vulnerability affecting Zephyr Bluetooth GATT notification and indication permission enforcement.
Affected Products
- Not Available (record rejected; see CVE-2026-2411 for affected Zephyr versions)
Discovery Timeline
- 2026-08-01 - CVE-2026-10772 published to NVD as a rejected duplicate
- 2026-08-01 - Last updated in NVD database
Technical Details for CVE-2026-10772
Vulnerability Analysis
CVE-2026-10772 does not describe an independent vulnerability. The Zephyr Project CNA rejected the identifier because it duplicates CVE-2026-2411, which was assigned earlier for the same defect. The underlying issue referenced by both records exists in the Zephyr Bluetooth host GATT implementation at subsys/bluetooth/host/gatt.c. The notify and indicate code paths inspect the permission bits of the Characteristic Declaration attribute rather than the Characteristic Value attribute. Because encryption and authentication requirements are configured on the value attribute, those requirements are silently bypassed on the notify and indicate paths.
Root Cause
The defect is an authorization check performed against the wrong attribute object [CWE-863, Incorrect Authorization]. GATT services typically expose a Characteristic Declaration attribute and a Characteristic Value attribute; security requirements such as BT_GATT_PERM_READ_ENCRYPT or BT_GATT_PERM_READ_AUTHEN are attached to the value. The notify and indicate handlers referenced the declaration attribute when validating permissions, so the value-level constraints never applied.
Attack Vector
Since this identifier is rejected, no exploitation details are tracked under CVE-2026-10772. The technical attack surface described by the duplicate defect involves a Bluetooth peer receiving GATT notifications or indications for characteristics that should require an encrypted or authenticated link. Refer to CVE-2026-2411 for scoring, attack complexity, and impact analysis.
No verified exploitation code is associated with this rejected record.
See CVE-2026-2411 for the tracked defect and fix commit c3386f92fe81bd10dc23e6a115e6a80a7d863546.
Detection Methods for CVE-2026-10772
Indicators of Compromise
- No indicators of compromise are tracked under CVE-2026-10772 because the record is rejected as a duplicate.
- For hunting related to the underlying defect, consult guidance published under CVE-2026-2411.
Detection Strategies
- Update vulnerability management tooling to alias CVE-2026-10772 to CVE-2026-2411 so scan results, tickets, and dashboards do not report the same defect twice.
- Inventory firmware and embedded devices built on Zephyr RTOS and correlate build metadata against the fix commit c3386f92fe81bd10dc23e6a115e6a80a7d863546.
Monitoring Recommendations
- Monitor the Zephyr Project security advisories and NVD entry for CVE-2026-2411 for any updates to affected version ranges.
- Track SBOM entries that reference the Zephyr Bluetooth host component and flag builds predating the fix commit.
How to Mitigate CVE-2026-10772
Immediate Actions Required
- Treat CVE-2026-10772 as a documentation artifact and redirect remediation work to CVE-2026-2411.
- Deduplicate any open tickets, risk register entries, or scanner findings that list both identifiers for the same asset.
Patch Information
The underlying defect is fixed by upstream Zephyr commit c3386f92fe81bd10dc23e6a115e6a80a7d863546, which corrects the permission check in subsys/bluetooth/host/gatt.c to reference the Characteristic Value attribute. Apply Zephyr releases that include this commit as directed by the advisory for CVE-2026-2411.
Workarounds
- No workarounds are published for the rejected identifier; consult the CVE-2026-2411 advisory for any interim guidance from the Zephyr Project.
- Where feasible, restrict Bluetooth pairing and enforce bonded, encrypted links at the application layer until firmware containing the fix commit is deployed.
# No configuration change applies to the rejected identifier.
# Track and remediate under CVE-2026-2411.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
