Use-After-Free Vulnerability in Bluetooth Host Layer of Zephyr RTOS

CVE-2026-11368

What is CVE-2026-11368?

A use-after-free vulnerability exists in the Bluetooth host ATT layer of Zephyr RTOS, where improper handling of TX buffers and channel destruction can lead to a denial of service. Specifically, if a remote peer disconnects while an ATT PDU is in transit, the channel may be freed while the buffer is still referenced, resulting in memory corruption and potential crashes. The issue arises from the deferred processing of buffer destruction in the system workqueue, necessitating updates to prevent dereferencing freed memory.

References