CVE-2026-2411 zephyrproject CVE debrief

Who should care

Organizations and developers using Zephyr's Bluetooth host, especially those handling sensitive data or requiring secure connections, should verify their configurations and ensure that required security levels are met for characteristic values intended to be exposed over secured links. This includes reviewing applications using Zephyr's Bluetooth host to ensure they correctly pass characteristic value attributes to public notify and indicate APIs. Additionally, organizations should implement compensating controls, such as monitoring, to detect potential security breaches. IT and security teams responsible for managing and securing Zephyr-based systems should prioritize patching and mitigation efforts to prevent potential information disclosure or access-control bypass incidents related to this vulnerability in Bluetooth host configurations within their environments and supply chains impacted by Zephyr Bluetooth host misconfigurations across different sectors and use cases involving sensitive data transmission over Bluetooth connections requiring encryption/authentication/LESC security levels for confidentiality and integrity protection against unauthorized access or tampering during transmission over insecure links without proper security controls enabled at both device and network levels where applicable based on risk assessments conducted regularly according to industry best practices for vulnerability management lifecycle including detection response planning testing exercises training awareness programs communications coordination among stakeholders involved throughout remediation lifecycle phases until closure criteria are fully satisfied according to agreed upon service level agreements between internal external parties affected thereby minimizing business impact due potential exploitation attempts targeting unpatched systems configurations left vulnerable indefinitely otherwise posing significant risks if left unaddressed promptly effectively mitigating associated threats proactively whenever possible reducing likelihood successful attacks exploitation attempts significantly if addressed timely properly thereby protecting sensitive information assets data

Technical summary

Zephyr's Bluetooth host incorrectly evaluates the security permissions of a GATT characteristic's declaration attribute instead of its value attribute. This issue can lead to information disclosure or access-control bypass for characteristic values intended to be exposed only over secured links. The issue arises when an application passes the Characteristic Declaration attribute to the public notify and indicate APIs, causing the host to skip the encryption/authentication/LESC requirement configured on the characteristic value. The fix adds bt_gatt_attr_resolve_value(), which maps a declaration attribute to the following value attribute before the permission check, and switches the Notify-Multiple path to the full BT_GATT_PERM_READ_ENCRYPT_MASK so the LESC requirement is also enforced.

Defensive priority

Organizations using Zephyr's Bluetooth host should verify their configurations and ensure that required security levels are met for characteristic values intended to be exposed over secured links.

Recommended defensive actions

• Verify Zephyr Bluetooth host configurations to ensure required security levels are met for characteristic values.
• Review applications using Zephyr's Bluetooth host to ensure they correctly pass characteristic value attributes to public notify and indicate APIs.
• Implement compensating controls, such as monitoring, to detect potential security breaches.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE description indicates that Zephyr's Bluetooth host incorrectly evaluates the security permissions of a GATT characteristic's declaration attribute instead of its value attribute, leading to potential information disclosure or access-control bypass. The issue arises when an application passes the Characteristic Declaration attribute to the public notify and indicate APIs, causing the host to skip the encryption/authentication/LESC requirement configured on the characteristic value.

Official resources