CVE-2026-11368

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description A use-after-free issue exists in the Bluetooth host ATT layer within the subsys/bluetooth/host/att.c file. The system associates in-flight ATT TX buffers with their owning channel using the tx meta data storage[] array. When a buffer's last reference is dropped, completion handling is deferred to the system workqueue through a sequence of calls: att tx destroy to att tx destroy work handler to att on sent cb and finally to bt att sent(), which dereferences the channel and its ATT context via sys slist get(&att->reqs).

If a remote peer disconnects while an ATT PDU is still in flight, L2CAP tears down the channel in l2cap chan del(), executing the bt att released() callback to free the channel slab slot. Since the in-flight buffer is held by the connection TX path, the deferred destroy work may execute after the channel is freed. Consequently, the att on sent cb guard dereferences meta->att chan, which becomes a dangling pointer. A remote peer can trigger this by disconnecting during routine ATT traffic without requiring pairing or user interaction, leading to a use-after-free read/write that can crash the Bluetooth host or corrupt live memory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.