Zephyr RTOS CVE-2026-15460

Target device must run Zephyr 1.6.0 through pre-4.4.2 compiled with Bluetooth Classic support (CONFIG_BT_BREDR=y) and must be discoverable or connectable by the attacker. Attacker must be within Bluetooth radio range and must send the crafted data PDU during the window between CID assignment in BT_L2CAP_CONNECTING state and the channel reaching BT_L2CAP_CONNECTED - this window is observable via on-air Bluetooth sniffing. For PSMs that enforce security, the vulnerability is exploitable before the security handshake, so the attacker does not need to be a previously paired device. The more severe dangling-pointer path additionally requires that the targeted channel object be a reused pool entry with a non-null stale _sdu pointer, which is not deterministically attacker-controllable and depends on prior channel allocation/deallocation history on the target device.

With CVSS 5.4 (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L), the attack is bounded to Bluetooth radio range - typically 10 to 100 meters - which eliminates internet-scale mass exploitation but is operationally meaningful in dense shared environments such as hospitals, office buildings, and transit hubs where IoT devices running Zephyr may coexist with untrusted parties. The AC:L rating is appropriate since no preconditions beyond physical proximity are required; timing the PDU into the half-open CID window involves only observing the on-air connection setup sequence. The dangling _sdu pointer scenario represents a latent memory-safety concern that the C:N/I:L/A:L vector may understate in channel-reuse-heavy workloads, and this warrants patch urgency beyond what the numeric score alone conveys - even a mid-sized municipal IT team in inowroclaw managing Bluetooth-enabled IoT infrastructure should treat this as a scheduled patch rather than deferred maintenance. No EPSS score was supplied and the vulnerability is absent from CISA KEV with no known public exploit, consistent with the medium score and adjacency constraint. The SSVC technical impact is partial (bounded DoS plus data injection), exploitation is not confirmed as automated, and the scope is unchanged, making this a genuine medium-priority adjacency risk for Bluetooth Classic-enabled Zephyr deployments only - BLE-only builds are unaffected.

An attacker within Bluetooth radio range initiates an L2CAP connection request to a Zephyr device; once the CID is assigned and the channel enters BT_L2CAP_CONNECTING, the attacker immediately transmits a data PDU addressed to that CID before the channel reaches BT_L2CAP_CONNECTED. If the targeted channel object was previously allocated and freed without clearing the _sdu pointer, bt_l2cap_br_ret_fc_recv() dereferences the stale pointer, causing the Bluetooth link manager to tear down the connection. No public proof-of-concept exploit has been identified.