CVE-2026-11368: Bluetooth ATT Use-After-Free Vulnerability

CVE-2026-11368 Overview

CVE-2026-11368 is a use-after-free vulnerability [CWE-416] in the Zephyr RTOS Bluetooth host stack, specifically in the Attribute Protocol (ATT) layer implemented in subsys/bluetooth/host/att.c. A remote peer with an active ATT connection can trigger the flaw by disconnecting while an ATT PDU is still in flight in the controller transmit path. The deferred completion callback then dereferences a dangling channel pointer after the Logical Link Control and Adaptation Protocol (L2CAP) layer has freed the channel slab slot. Exploitation requires no pairing and no user interaction over the Bluetooth adjacent-network attack surface.

Critical Impact
Reliable Bluetooth host crash (denial of service) with potential memory corruption via reuse of the freed channel slab slot.

Affected Products

Zephyr RTOS Bluetooth host subsystem (subsys/bluetooth/host/att.c)
Devices built on Zephyr with the ATT bearer enabled
Products relying on the Zephyr Bluetooth Low Energy (BLE) host stack

Discovery Timeline

2026-08-04 - CVE-2026-11368 published to the National Vulnerability Database (NVD)
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-11368

Vulnerability Analysis

The Zephyr ATT layer associates each in-flight ATT TX buffer with its owning channel through the static tx_meta_data_storage[] array, storing the channel pointer in data->att_chan = chan. When the buffer's last reference drops, the net-buf destroy callback defers completion to the system workqueue through the chain att_tx_destroy -> att_tx_destroy_work_handler -> att_on_sent_cb -> bt_att_sent. The final function dereferences the channel and its ATT context via sys_slist_get(&att->reqs).

If the peer disconnects while an ATT PDU (a server notification, indication, or response) remains in flight, L2CAP tears the channel down inside l2cap_chan_del(). That routine invokes the disconnected callback followed by bt_att_released, which frees the channel slab slot. The in-flight buffer, however, is held by the connection transmit path rather than the channel's own queue, so its deferred destroy work executes after the channel memory has been released.

Root Cause

The guard in att_on_sent_cb was intended to drop stale callbacks, but the guard itself reads meta->att_chan — a dangling pointer into a freed and possibly reused slab entry. The lifetime of tx_meta_data_storage[] entries is not synchronized with channel teardown.

Attack Vector

A remote peer with an ATT connection triggers the condition by disconnecting during routine ATT traffic. The ATT bearer is reachable without pairing or user interaction. The result is a use-after-free read and write of freed channel memory, which reliably crashes the Bluetooth host and can corrupt live memory if the slab slot is reused.

// Patch: subsys/bluetooth/host/att.c - bt_att_released()
// Source: https://github.com/zephyrproject-rtos/zephyr/commit/dfdea9bad8d9b5b31c125e97fcffb549f2217caa

	LOG_DBG("chan %p", chan);

	/* Drop any pending/in-flight ATT TX metadata still referencing this
	 * channel, so the deferred att_on_sent_cb()/bt_att_sent() work cannot
	 * dereference the channel after it is freed here. Bluetooth uses a
	 * cooperative system workqueue, so this runs serialized with
	 * att_tx_destroy_work_handler() and aligned pointer writes are atomic.
	 */
	ARRAY_FOR_EACH(tx_meta_data_storage, i) {
		if (tx_meta_data_storage[i].att_chan == chan) {
			tx_meta_data_storage[i].att_chan = NULL;
		}
	}

	k_mem_slab_free(&chan_slab, (void *)chan);

Source: Zephyr commit dfdea9b

Detection Methods for CVE-2026-11368

Indicators of Compromise

Unexpected reboots or hard faults on Zephyr-based devices immediately after a BLE peer disconnects.
Kernel logs showing crashes inside bt_att_sent, att_on_sent_cb, or att_tx_destroy_work_handler on the system workqueue.
Repeated short-lived BLE ATT connections from an unknown peer followed by abrupt link terminations.

Detection Strategies

Enable Zephyr fault reporting and coredump collection to capture the exact instruction pointer at crash time inside the ATT callback chain.
Instrument the Bluetooth host with CONFIG_BT_DEBUG_ATT and CONFIG_BT_DEBUG_L2CAP in test builds to log channel teardown ordering.
Correlate BLE host controller interface (HCI) disconnect events with subsequent workqueue faults to identify the vulnerable sequence.

Monitoring Recommendations

Aggregate device crash telemetry from fleet management systems and flag clusters correlated with BLE proximity events.
Track HCI logs for peers that repeatedly connect and disconnect during active ATT traffic.
Alert on any RTOS-level exception on Bluetooth-enabled products, treating unexplained resets as candidate exploitation attempts.

How to Mitigate CVE-2026-11368

Immediate Actions Required

Apply the upstream Zephyr fix in commit dfdea9b to subsys/bluetooth/host/att.c and rebuild affected firmware.
Rebuild and redistribute firmware for all Zephyr-based products that expose the BLE ATT bearer.
Inventory devices running vulnerable Zephyr Bluetooth host builds and prioritize field updates.

Patch Information

The fix modifies bt_att_released() to walk tx_meta_data_storage[] and NULL every entry whose att_chan still references the channel being freed. Because teardown and the destroy work both run on the cooperative system workqueue, the array update is serialized and requires no additional locking. The deferred guard in att_on_sent_cb then observes a NULL pointer and drops the callback safely. See the GitHub Security Advisory GHSA-85vg-gwc4-77g7 for the coordinated disclosure record.

Workarounds

Where feasible, disable the ATT server or restrict advertising so that untrusted peers cannot establish an ATT connection.
Reduce Bluetooth transmit power or limit connectable windows in deployments where patching is delayed.
Enforce link-layer allow-lists to accept ATT connections only from bonded peers as an interim risk-reduction measure.

bash

# Rebuild Zephyr with the upstream fix
git fetch origin
git cherry-pick dfdea9bad8d9b5b31c125e97fcffb549f2217caa
west build -b <board> -p auto samples/bluetooth/peripheral
west flash