CVE-2026-5068

Name of the Vulnerable Software and Affected Versions Zephyr Project (affected versions not specified)

Description A remote, unauthenticated BLE peer can trigger a 2-byte out-of-bounds write in the Bluetooth host during L2CAP LE CoC SDU reassembly. This occurs when the application enables segmentation via chan ops.alloc buf and the selected RX pool has a user data size smaller than 2 bytes. In this scenario, the segmentation counter stored in the net buf user data area is written out of bounds within the l2cap chan le recv seg() function. This can lead to heap corruption or fatal errors.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.