Out-of-bounds access in Zephyr BR/EDR L2CAP configuration request handling (CVE-2026-10680)

The Classic Bluetooth (BR/EDR) L2CAP signaling handlers `l2cap_br_conf_req()` and `l2cap_br_conf_rsp()` in Zephyr incorrectly validate the per-command data length against the full PDU buffer length (`buf->len`) rather than the signaling header's per-command length field (`len`). A crafted CONF_REQ command with a header length smaller than the configuration-request structure causes a `uint16_t` underflow of `opt_len` to a near-0xFFFF value, after which an unbounded option-parsing loop walks far past the end of the pooled ACL receive buffer via unchecked pull primitives, producing an out-of-bounds read and, when out-of-bounds bytes encode an MTU or flush-timeout option, an out-of-bounds write. Because the BR/EDR signaling channel is processed before pairing or encryption, an unauthenticated peer within radio range that can establish an ACL connection can trigger memory corruption and denial of service (host/device crash) without any prior authentication. Affected versions: - >= 4.2.0, < 4.3.1 - >= 4.4.0, <= 4.4.1 We recommend updating to: 4.3.1, 4.5.0. CVSS 7.6 · our assessment: this_week Reference: https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-vrwx-p97q-8854 Details: https://vuln.today/cve/CVE-2026-10680