CVE-2026-12236

Name of the Vulnerable Software and Affected Versions (affected versions not specified)

Description The Bluetooth host GATT client function parse read std char desc() in subsys/bluetooth/host/gatt.c fails to validate the minimum value of the per-entry stride rsp->len received from a remote GATT server during BT GATT DISCOVER STD CHAR DESC discovery. A malicious or malfunctioning peer can send a response where rsp->len is 0, causing the parse loop to enter an infinite state because the exit condition is never met and the read pointer does not advance. This results in a denial of service of the Bluetooth subsystem, potentially triggering a watchdog reset on constrained targets. This condition can be triggered by any connected unauthenticated adjacent attacker once the local device initiates standard-descriptor-value discovery.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.