CVE-2026-2411

Name of the Vulnerable Software and Affected Versions Zephyr (affected versions not specified)

Description Zephyr's Bluetooth host incorrectly handles security permission checks when sending notifications or indications. When a Characteristic Declaration attribute is used, the host evaluates the declaration's hard-coded permissions instead of the application-specified security permissions of the Characteristic Value attribute. This occurs within the gatt notify(), gatt indicate(), and gatt notify multiple verify params() functions in subsys/bluetooth/host/gatt.c. Additionally, the Notify-Multiple path uses a mask that fails to enforce LE Secure Connections (LESC) requirements.

A remote peer can trigger this issue by connecting and writing to the Client Characteristic Configuration descriptor to enable notifications or indications. This allows the server to transmit protected values over a link that does not meet the required security level, leading to information disclosure or an access-control bypass for characteristic values intended for secured links.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.