{"affected":[{"defaultStatus":"unaffected","ecosystem":"https://github.com/zephyrproject-rtos/zephyr","packageName":"zephyr","product":"zephyr","source":"CNA: zephyr","vendor":"zephyrproject","versions":[{"lessThan":"4.3.2","status":"affected","version":"1.6.0","versionType":"semver"},{"lessThan":"4.4.2","status":"affected","version":"4.4.0","versionType":"semver"}]}],"cveId":"CVE-2026-15460","cwes":["CWE-666"],"description":"The Bluetooth Classic (BR/EDR) L2CAP receive handler bt_l2cap_br_recv() in subsys/bluetooth/host/classic/l2cap_br.c dispatched inbound data PDUs based only on the destination channel ID, without checking that the target channel had reached the BT_L2CAP_CONNECTED state. A dynamic channel is assigned its RX CID and added to the connection's channel list while still in BT_L2CAP_CONNECTING (and later BT_L2CAP_CONFIG) — before configuration completes and, for PSMs that require security, before the peer is authenticated (l2cap_br_conn_req()).\n\nBecause the channel is already findable by bt_l2cap_br_lookup_rx_cid() during this window, a remote peer within radio range can send a data PDU addressed to that CID and have it processed on a not-yet-established channel. The dispatch keys off channel fields (BR_CHAN(chan)->rx.mode, rx.mps) that are only initialized during configuration by l2cap_br_conf(); since channel objects are pooled and bt_l2cap_br_chan_del() does not reset rx.mode or the reassembly buffer _sdu, a reused channel can carry stale state into the CONNECTING window and route the frame into the retransmission/flow-control path (bt_l2cap_br_ret_fc_recv()) with stale parameters and a possibly stale _sdu pointer.\n\nThe impact is delivery of attacker data to upper-layer protocol handlers on a half-open (and possibly unauthenticated) channel, plus operation on stale or partially initialized channel state on reused channel objects — leading to channel/link teardown (denial of service) and, in the stale-_sdu case, a dangling-pointer condition. The fix adds an explicit BR_CHAN(chan)->state < BT_L2CAP_CONNECTED guard that drops any data received before the channel is fully connected.","epss":{"date":"2026-11-03","percentile":0.16327,"score":0.00249},"exploits":[],"kev":null,"metrics":[{"score":5.4,"severity":"medium","source":"CNA: zephyr","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},{"score":5.4,"severity":"medium","source":"NVD: vulnerabilities@zephyrproject.org","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","version":"3.1"}],"modifiedAt":1793769523573,"publishedAt":1788993646492,"references":[{"source":"CNA: zephyr","tags":["patch"],"url":"https://github.com/zephyrproject-rtos/zephyr/commit/2738ee921ba61ba2e644c95bceba302896dd8c19"},{"source":"CNA: zephyr","tags":[],"url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-hx89-rm6c-hjrh"},{"source":"vulnerabilities@zephyrproject.org","tags":[],"url":"https://github.com/zephyrproject-rtos/zephyr/commit/2738ee921ba61ba2e644c95bceba302896dd8c19"},{"source":"vulnerabilities@zephyrproject.org","tags":[],"url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-hx89-rm6c-hjrh"}],"remediation":[{"kind":"fix","source":"CNA: zephyr","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/zephyrproject-rtos/zephyr/commit/2738ee921ba61ba2e644c95bceba302896dd8c19"}],"revision":"b6436d03196d3cb31337ae9885133dc9ec0d32a082008c4e8d7383664df88179","sources":[{"modifiedAt":1793768408211,"name":"CNA: zephyr","retrievedAt":1793769048657,"url":"https://www.cve.org/CVERecord?id=CVE-2026-15460"},{"modifiedAt":1793769523573,"name":"NVD","retrievedAt":1793772964635,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15460"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793769081620,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-15460"}],"ssvc":{"assessedAt":1789062621102,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Missing channel-state validation in Zephyr Bluetooth Classic L2CAP receive path","updatedAt":1793772964635}