CVE-2026-2411: Zephyr Bluetooth Information Disclosure

CVE-2026-2411 Overview

CVE-2026-2411 is an access-control bypass in the Zephyr real-time operating system's Bluetooth host stack. The Generic Attribute Profile (GATT) layer skips the encryption, authentication, or LE Secure Connections (LESC) requirement configured on a characteristic value when applications pass the Characteristic Declaration attribute to the notify or indicate APIs. A remote peer within Bluetooth range can enable notifications or indications on a Client Characteristic Configuration (CCC) descriptor and receive protected characteristic values over an unsecured link. The weakness is tracked as [CWE-863: Incorrect Authorization].

Critical Impact
Remote adjacent-network attackers can read GATT characteristic values that the application intended to expose only over an encrypted, authenticated, or LESC-secured Bluetooth link.

Affected Products

Zephyr Project real-time operating system Bluetooth host (subsys/bluetooth/host/gatt.c)
Applications declaring BT_GATT_PERM_READ_ENCRYPT, BT_GATT_PERM_READ_AUTHEN, or BT_GATT_PERM_READ_LESC on notify or indicate characteristics
Devices using the Zephyr Notify-Multiple GATT path

Discovery Timeline

2026-08-01 - CVE-2026-2411 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-2411

Vulnerability Analysis

Zephyr represents each GATT characteristic as two consecutive attributes. The Characteristic Declaration attribute has its permission hard-coded to BT_GATT_PERM_READ. The following Characteristic Value attribute carries the application-defined security permissions such as BT_GATT_PERM_READ_ENCRYPT, BT_GATT_PERM_READ_AUTHEN, or BT_GATT_PERM_READ_LESC. The public bt_gatt_notify_cb() and indicate APIs accept either attribute, and passing the declaration is the documented idiom.

Before emitting each notification or indication, the host invokes bt_gatt_check_perm() against params->attr in gatt_notify(), gatt_indicate(), and gatt_notify_multiple_verify_params(). This check runs against the declaration's permissive attribute rather than the value's protected attribute, silently satisfying the security gate.

Root Cause

When the caller supplies the Characteristic Declaration, the host redirects the value handle for transmission but leaves params->attr pointing at the declaration. The permission check then evaluates the declaration's BT_GATT_PERM_READ instead of the value's encryption or authentication requirements. The Notify-Multiple path compounds the flaw by using a mask that omits the LESC bit.

Attack Vector

A remote peer within Bluetooth range connects to the target, optionally without pairing or encryption. The peer writes the CCC descriptor to enable notifications or indications on a characteristic whose value permissions demand a secured link. The server then transmits the protected value over the unsecured connection. Exploitation requires the application to have declared encrypt- or authenticate-required notify/indicate characteristics and the CCC to be writable at a lower security tier.

	return found;
 }
 
+/**
+ * This function is meant to resolve attr to the characteristic value attribute.
+ * If attr is a characteristic declaration, returns the next attribute (the value).
+ * Otherwise returns attr unchanged.
+ */
+static const struct bt_gatt_attr *
+bt_gatt_attr_resolve_value(const struct bt_gatt_attr *attr)
+{
+	/* Due to the following requirement in the Core Spec Version 6.3 | Vol 3, Part G,
+	 * Section 3.3 we can always assume that the next attribute is the Characteristic Value:
+	 * The Characteristic Value declaration shall exist immediately following the
+	 * characteristic declaration.
+	 */
+	if (bt_uuid_cmp(attr->uuid, BT_UUID_GATT_CHRC) == 0) {
+		return bt_gatt_attr_next(attr);
+	}
+
+	return attr;
+}
+
 int bt_gatt_notify_cb(struct bt_conn *conn,
 		      struct bt_gatt_notify_params *params)
 {

Source: Zephyr GitHub commit c3386f92fe81bd10dc23e6a115e6a80a7d863546

Detection Methods for CVE-2026-2411

Indicators of Compromise

Unpaired or unencrypted Bluetooth Low Energy connections that successfully write to CCC descriptors on characteristics configured with encryption or authentication requirements.
GATT notification or indication PDUs transmitted on links that have not completed pairing or reached the required security level.
Repeated CCC descriptor writes from peers immediately after connection establishment without a preceding pairing exchange.

Detection Strategies

Audit Zephyr firmware against the patched bt_gatt_attr_resolve_value() helper and verify that Notify-Multiple paths use BT_GATT_PERM_READ_ENCRYPT_MASK.
Instrument test peers to enable notifications without pairing and confirm the target refuses to transmit protected characteristic values.
Review application code that calls bt_gatt_notify_cb() or indicate APIs to confirm which attribute pointer is passed and whether the value's security permissions are enforced.

Monitoring Recommendations

Log GATT security level transitions and correlate CCC writes with the current link encryption state.
Capture Bluetooth HCI traces during penetration testing to validate that protected values are not emitted on unsecured links.
Track Zephyr project security advisories for follow-on fixes referencing GHSA-4w3r-v9q9-4462.

How to Mitigate CVE-2026-2411

Immediate Actions Required

Apply the upstream Zephyr fix that introduces bt_gatt_attr_resolve_value() and switches the Notify-Multiple path to BT_GATT_PERM_READ_ENCRYPT_MASK.
Rebuild and redeploy firmware for all devices using vulnerable Zephyr Bluetooth host revisions.
Inventory GATT services and identify characteristics that rely on BT_GATT_PERM_READ_ENCRYPT, BT_GATT_PERM_READ_AUTHEN, or BT_GATT_PERM_READ_LESC for confidentiality.

Patch Information

The fix is committed to the Zephyr project in commit c3386f92fe81bd10dc23e6a115e6a80a7d863546. The patch adds bt_gatt_attr_resolve_value(), which maps a declaration attribute to the following value attribute before the permission check. See the Zephyr Security Advisory GHSA-4w3r-v9q9-4462 for the coordinated disclosure details.

Workarounds

Update application code to pass the Characteristic Value attribute rather than the Characteristic Declaration to bt_gatt_notify_cb() and indicate APIs until the patch is deployed.
Raise the CCC descriptor's write permission to require encryption or authentication so unpaired peers cannot enable notifications.
Enforce LE Secure Connections at the application layer by refusing GATT operations on links that have not reached the required security level.

bash

# Rebuild Zephyr with the upstream fix applied
cd zephyr
git fetch origin
git cherry-pick c3386f92fe81bd10dc23e6a115e6a80a7d863546
west build -b <board> samples/bluetooth/peripheral -p always