CVE-2026-5068: bt: l2cap le coc: remote oob write via seg counter stored in net_buf user_data
A remote, unauthenticated BLE peer can trigger a 2-byte out-of-bounds write in the Bluetooth host during L2CAP LE CoC SDU reassembly. When the application enables segmentation (via chanops.allocbuf) and the chosen RX pool has a userdatasize smaller than 2 bytes, the segmentation counter stored in the netbuf userdata area is written out of bounds in l2capchanlerecvseg (subsys/bluetooth/host/l2cap.c). The observed effects are an AddressSanitizer abort and, without ASan, heap corruption / fatal error.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5068?
CVE-2026-5068 has a severity score of 7.6, categorized as high.
How does CVE-2026-5068 affect the Zephyr Project?
CVE-2026-5068 allows a remote unauthenticated BLE peer to cause a 2-byte out-of-bounds write in the Bluetooth host.
What conditions must be met for CVE-2026-5068 to be exploited?
To exploit CVE-2026-5068, segmentation must be enabled in the Bluetooth host, and the RX pool's user_data_size needs to be smaller than 2 bytes.
What is the impact of CVE-2026-5068 on system security?
CVE-2026-5068 can lead to a high impact denial of service due to the out-of-bounds write vulnerability.
How can I mitigate the risks associated with CVE-2026-5068?
To mitigate CVE-2026-5068, ensure that the user_data_size is appropriately configured to avoid out-of-bounds writes.