{"id":"CVE-2026-5068","title":"bt: l2cap le coc: remote oob write via seg counter stored in net_buf user_data","summary":"A remote, unauthenticated BLE peer can trigger a 2-byte out-of-bounds write in the Bluetooth host during L2CAP LE CoC SDU reassembly. When the application enables segmentation (via chan_ops.alloc_buf) and the chosen RX pool has a user_da…","severity":"high","cvss":7.6,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","cvssSource":"cna","cwe":["CWE-787"],"vendor":"zephyrproject-rtos","product":"Zephyr","affected":["Zephyr >= 1.14.0 < 4.3.1"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-06-09T13:10:35.371642Z"},"published":"2026-06-09","updated":"2026-10-15","sourceUpdated":"2026-10-15T22:10:25.872Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-5068","references":[{"url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-qrcq-hxwj-mqxm"}],"tags":["cve.org"],"epss":0.00322,"epssPercentile":0.23578,"ingestedAt":"2026-10-15T22:48:25.575Z","slug":"CVE-2026-5068","body":"## Overview\n\nA remote, unauthenticated BLE peer can trigger a 2-byte out-of-bounds write in the Bluetooth host during L2CAP LE CoC SDU reassembly. When the application enables segmentation (via chan_ops.alloc_buf) and the chosen RX pool has a user_data_size smaller than 2 bytes, the segmentation counter stored in the net_buf user_data area is written out of bounds in l2cap_chan_le_recv_seg (subsys/bluetooth/host/l2cap.c). The observed effects are an AddressSanitizer abort and, without ASan, heap corruption / fatal error.\n\n## Affected\n\n- `Zephyr >= 1.14.0 < 4.3.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":41.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}