summary
- a remote unauthenticated ble peer can trigger a 2-byte out-of-bounds write in the bluetooth host during le coc sdu reassembly when the application enables segmentation (chan_ops.alloc_buf) and the chosen rx pool has user_data_size < 2.
- observed end effects: (a) asan abort with a backtrace to
subsys/bluetooth/host/l2cap.c:2618, and (b) without asan, heap corruption/fatal error in a freelist-poisoning harness.
pins
Patches
main: #104913
v4.3: #108335
For more information
If you have any questions or comments about this advisory:
embargo: 2026-05-21
summary
subsys/bluetooth/host/l2cap.c:2618, and (b) without asan, heap corruption/fatal error in a freelist-poisoning harness.pins
subsys/bluetooth/host/l2cap.c:2618(l2cap_chan_le_recv_seg)zephyr/subsys/bluetooth/host/l2cap.c
Line 2618 in 02191db
Patches
main: #104913
v4.3: #108335
For more information
If you have any questions or comments about this advisory:
embargo: 2026-05-21