Zephyr RTOS CVE-2026-11368

The only mandatory condition is that the attacker be within Bluetooth radio range of a device running Zephyr 4.4.0 to <4.5.0 with the Bluetooth host stack compiled in and Bluetooth advertising or accepting connections. No pairing, bonding, authentication, or prior relationship is required - the ATT bearer is reachable immediately upon connection establishment per the CVSS PR:N/UI:N vector and explicit statement in the description. The attack requires timing a disconnect while an ATT PDU is in-flight in the controller TX path, but this is an inherent timing condition of any ATT exchange rather than a difficult race to engineer. Exploitation is limited by: (1) Bluetooth radio range (typically 10-100 m depending on hardware class), (2) the specific affected version range 4.4.0 to <4.5.0, and (3) Bluetooth must be enabled in the build and the device must be connectable. Configurations that require pairing before ATT access (GATT security level enforcement) do not eliminate the vulnerability but require the attacker to complete pairing first, raising the bar from fully anonymous to at minimum an authenticated-but-untrusted peer.

The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H, score 7.1) accurately reflects the key risk constraints. The adjacent-network vector (AV:A) is the primary real-world limiter - exploitation requires the attacker to be within Bluetooth radio range, which substantially reduces the threat surface compared to internet-facing vulnerabilities. AC:L and PR:N confirm the race is easy to trigger and requires no credentials or pairing, which elevates practical exploitability for proximate attackers. The A:H (reliable crash) is the confirmed primary impact; I:L captures the possibility that a reused slab slot could yield a memory write, though full integrity compromise is not independently confirmed. No EPSS data was provided in the input. No KEV listing and no public POC exist at time of analysis, consistent with a freshly patched upstream vulnerability. The overall risk profile is moderate for IoT and embedded deployments in physically accessible environments (factory floors, hospitals, consumer settings), and low for air-gapped or access-controlled deployments. CVSS does not distinguish between reliable DoS and speculative code execution - defenders should treat A:H as the confirmed outcome and I:L as a theoretical upper bound pending further research.

An attacker within Bluetooth radio range discovers an advertising Zephyr 4.4.x device, establishes a BLE connection without pairing, and immediately begins issuing ATT read or write requests to any GATT characteristic. While a response PDU is still queued in the controller TX path, the attacker abruptly drops the link. L2CAP tears down the channel and frees its slab slot; a fraction of a millisecond later, the system workqueue callback dereferences the now-freed (and possibly reused) att_chan pointer, crashing the Bluetooth host. No public exploit code has been identified, but the race is straightforward to reproduce with standard BLE tooling given physical proximity.