PatchSiren cyber security CVE debrief
CVE-2026-10680 zephyrproject CVE debrief
CVE-2026-10680 is a high-severity vulnerability in the Zephyr Bluetooth Classic (BR/EDR) L2CAP signaling handlers. The vulnerability arises from incorrect validation of command sizes, allowing an attacker to trigger an out-of-bounds read and write, leading to memory corruption and denial of service. This flaw is particularly concerning because it can be exploited by an unauthenticated peer within radio range that can establish an ACL connection, potentially leading to device crashes and memory corruption. The defect is present in released versions including v4.4.0, emphasizing the need for prompt patching.
- Vendor
- zephyrproject
- Product
- zephyr
- CVSS
- HIGH 7.6
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-07-21
- Original CVE updated
- 2026-07-22
- Advisory published
- 2026-07-21
- Advisory updated
- 2026-07-22
Who should care
Organizations using Zephyr-based Bluetooth devices, particularly those with unauthenticated peer connections, should prioritize patching this vulnerability to prevent potential memory corruption and denial-of-service attacks. This includes operators of devices that use Zephyr's Bluetooth Classic (BR/EDR) L2CAP signaling handlers, as well as security teams responsible for monitoring and mitigating vulnerabilities in their environments. Affected operators and platforms must assess their exposure and implement compensating controls where necessary.
Technical summary
The l2cap_br_conf_req() and l2cap_br_conf_rsp() functions in subsys/bluetooth/host/classic/l2cap_br.c incorrectly validate the minimum command size against buf->len instead of len. This allows an attacker to send a CONF_REQ command with a header length smaller than the configuration-request structure, followed by another command, causing an underflow and out-of-bounds read and write. The BR/EDR signaling channel is processed before pairing/encryption, making it possible for an L2CAP channel to an L0 service such as SDP to be opened without pairing. Consequently, an attacker can exploit this vulnerability to cause memory corruption and denial of service (host/device crash).
Defensive priority
High
Recommended defensive actions
- Apply the official patch from Zephyr
- Review and update affected Zephyr-based Bluetooth devices
- Implement compensating controls to monitor and restrict unauthenticated peer connections
- Conduct thorough inventory checks to identify vulnerable devices
- Monitor for suspicious activity and exception tracking
- Review system logs for potential exploitation attempts
- Track exceptions and retest remediated assets
Evidence notes
The CVE record was published on 2026-07-21T22:17:00.303Z and last modified on 2026-07-22T20:16:42.840Z. The NVD entry is currently Undergoing Analysis. Official references include the CVE record, NVD detail, and source item URL. The Zephyr Project has released a patch for this vulnerability, which is available on their official website. Users should verify the authenticity of the patch and apply it to affected systems. Additionally, defenders should review system logs for potential exploitation attempts and monitor for suspicious activity. Given the limited source detail, defenders are advised to proceed with caution and verify the information through additional evidence-limited means.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-21T22:17:00.303Z and has not been modified since then. The NVD entry is currently Undergoing Analysis.