CVE-2026-2411
- Source
- https://cve.org/CVERecord?id=CVE-2026-2411
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-2411.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-2411
- Aliases
-
- GHSA-4w3r-v9q9-4462
- Published
- 2026-08-01T12:06:41.538Z
- Modified
- 2026-08-07T15:14:05.876214Z
- Severity
-
- 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
- Summary
- Bluetooth GATT notify/indicate enforces the wrong attribute's permissions, bypassing encryption/authentication requirements on characteristic values
- Details
-
Zephyr's Bluetooth host declares a GATT characteristic as two consecutive attributes: a Characteristic Declaration whose permission is hard-coded to BTGATTPERMREAD, and a Characteristic Value attribute that carries the application-specified security permissions (e.g. BTGATTPERMREADENCRYPT / READAUTHEN / READLESC). The public notify and indicate APIs explicitly accept either attribute, and passing the declaration is the documented, common idiom. Before sending each notification or indication, the host re-checks link security with btgattcheckperm() against params->attr in gattnotify(), gattindicate(), and gattnotifymultipleverifyparams() (subsys/bluetooth/host/gatt.c).
When the application passed the Characteristic Declaration attribute, the host correctly redirected the value handle but left params->attr pointing at the declaration, so the security check evaluated the declaration's permissions (no security required) instead of the value's. As a result the encryption/authentication/LESC requirement configured on the characteristic value was skipped. The Notify-Multiple path additionally used a mask that omitted the LE Secure Connections requirement.
A remote peer triggers the disclosure by connecting (optionally without pairing or encryption) and writing the Client Characteristic Configuration descriptor to enable notifications or indications, causing the server to emit the protected value over a link that has not reached the required security level. The impact is information disclosure / access-control bypass for characteristic values the application intended to expose only over a secured link; exposure depends on the application declaring encrypt/authen-required notify/indicate characteristics and on the CCC being writable at a lower security tier. There is no memory-safety or availability impact.
The fix adds btgattattrresolvevalue(), which maps a declaration attribute to the following value attribute before the permission check, and switches the Notify-Multiple path to the full BTGATTPERMREADENCRYPT_MASK so the LESC requirement is also enforced.
- Database specific
{ "cna_assigner": "zephyr", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/2xxx/CVE-2026-2411.json", "unresolved_ranges": [ { "extracted_events": [ { "introduced": "2.6.0" }, { "fixed": "4.5.0" } ], "source": "AFFECTED_FIELD" } ], "cwe_ids": [ "CWE-863" ] }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/2xxx/CVE-2026-2411.json
- https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-4w3r-v9q9-4462
- https://nvd.nist.gov/vuln/detail/CVE-2026-2411
- https://github.com/zephyrproject-rtos/zephyr/commit/c3386f92fe81bd10dc23e6a115e6a80a7d863546
- https://github.com/zephyrproject-rtos/zephyr
Affected packages
Git / github.com/zephyrproject-rtos/zephyr
Affected versions
v1.*
v2.*
v3.*
v4.*
zephyr-v1.*
zephyr-v2.*
zephyr-v3.*
Database specific
vanir_signatures
[
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"length": 1099.0,
"function_hash": "50635410577664793859733484142177879407"
},
"id": "CVE-2026-2411-02fac3b1",
"signature_type": "Function",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/c3386f92fe81bd10dc23e6a115e6a80a7d863546",
"target": {
"function": "bt_gatt_indicate",
"file": "subsys/bluetooth/host/gatt.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"length": 959.0,
"function_hash": "331088310273612927887489790181446672532"
},
"id": "CVE-2026-2411-41ff13a9",
"signature_type": "Function",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/c3386f92fe81bd10dc23e6a115e6a80a7d863546",
"target": {
"function": "gatt_notify_multiple_verify_params",
"file": "subsys/bluetooth/host/gatt.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"length": 1055.0,
"function_hash": "193569379748300501353079160115464796084"
},
"id": "CVE-2026-2411-caf9e354",
"signature_type": "Function",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/c3386f92fe81bd10dc23e6a115e6a80a7d863546",
"target": {
"function": "bt_gatt_notify_cb",
"file": "subsys/bluetooth/host/gatt.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"280633077291609947572343549468729551443",
"88535215696290815055558235935584874388",
"102145599979893741557339939307991790242",
"101505497117657978840264711665582541559",
"25854105132129506246892448076783364507",
"101276769553911956959272168253757116494",
"171963433194207899062298064766274558487",
"126140204941090969689809092023385130511",
"243893850453316699622425504432905117714",
"337970900237976246750835166859610888797",
"260589163737119170630289820393075604148",
"186002766863006492546459463282188136511",
"131137827171357103335291506019284264324",
"244650255959184198515422478253562159915",
"291568232083920409393298787462617343599",
"101505497117657978840264711665582541559",
"213621793004884024648360690051873609349",
"43941670213296943316393895818287066506"
]
},
"id": "CVE-2026-2411-e6bdebbc",
"signature_type": "Line",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/c3386f92fe81bd10dc23e6a115e6a80a7d863546",
"target": {
"file": "subsys/bluetooth/host/gatt.c"
}
}
]
vanir_signatures_modified
"2026-08-07T15:14:05Z"
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-2411.json"