CVE-2026-2411 in Zephyr
Summary
by MITRE • 08/01/2026
Zephyr's Bluetooth host declares a GATT characteristic as two consecutive attributes: a Characteristic Declaration whose permission is hard-coded to BT_GATT_PERM_READ, and a Characteristic Value attribute that carries the application-specified security permissions (e.g. BT_GATT_PERM_READ_ENCRYPT / READ_AUTHEN / READ_LESC). The public notify and indicate APIs explicitly accept either attribute, and passing the declaration is the documented, common idiom. Before sending each notification or indication, the host re-checks link security with bt_gatt_check_perm() against params->attr in gatt_notify(), gatt_indicate(), and gatt_notify_multiple_verify_params() (subsys/bluetooth/host/gatt.c).
When the application passed the Characteristic Declaration attribute, the host correctly redirected the value handle but left params->attr pointing at the declaration, so the security check evaluated the declaration's permissions (no security required) instead of the value's. As a result the encryption/authentication/LESC requirement configured on the characteristic value was skipped. The Notify-Multiple path additionally used a mask that omitted the LE Secure Connections requirement.
A remote peer triggers the disclosure by connecting (optionally without pairing or encryption) and writing the Client Characteristic Configuration descriptor to enable notifications or indications, causing the server to emit the protected value over a link that has not reached the required security level. The impact is information disclosure / access-control bypass for characteristic values the application intended to expose only over a secured link; exposure depends on the application declaring encrypt/authen-required notify/indicate characteristics and on the CCC being writable at a lower security tier. There is no memory-safety or availability impact.
The fix adds bt_gatt_attr_resolve_value(), which maps a declaration attribute to the following value attribute before the permission check, and switches the Notify-Multiple path to the full BT_GATT_PERM_READ_ENCRYPT_MASK so the LESC requirement is also enforced.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/01/2026
This vulnerability exists in Zephyr's Bluetooth host implementation within the Generic Attribute Profile (GATT) subsystem where a security flaw allows unauthorized disclosure of protected characteristic values through improper permission checking during notification and indication operations. The issue stems from how the system handles GATT characteristic declarations versus their corresponding value attributes, creating an exploitable gap in access control enforcement.
The technical flaw manifests when applications use the standard API idiom of passing the Characteristic Declaration attribute to notify or indicate functions instead of the actual Characteristic Value attribute. While the system correctly identifies and redirects to the appropriate value handle for transmission, it fails to update the permission checking context from the declaration to the value attribute. This design oversight occurs because the bt_gatt_check_perm() function operates on params->attr which continues to reference the declaration with its hard-coded BT_GATT_PERM_READ permissions rather than evaluating the actual security requirements configured on the Characteristic Value attribute.
The operational impact of this vulnerability enables remote attackers to access sensitive data that should only be available over authenticated and encrypted connections. When a peer connects without pairing or encryption and writes to the Client Characteristic Configuration descriptor to enable notifications or indications, the system sends protected characteristic values over an unsecured link. This represents a clear bypass of intended access controls as defined by CWE-284 Access Control Bypass, where the security requirements configured on the characteristic value are completely ignored due to the flawed permission evaluation mechanism.
The vulnerability affects both notification and indication operations through gatt_notify(), gatt_indicate(), and gatt_notify_multiple_verify_params() functions in subsys/bluetooth/host/gatt.c. The notify-multiple path contains an additional weakness where it uses a mask that excludes the LE Secure Connections requirement, further weakening the security posture. This issue maps to ATT&CK technique T1566.001 Phishing via Social Media and T1071.004 Application Layer Protocol: DNS, though primarily manifesting as an access control bypass rather than a direct network attack vector.
The fix implements bt_gatt_attr_resolve_value() which correctly maps declaration attributes to their corresponding value attributes before performing permission checks, ensuring that security requirements configured on the characteristic value are properly enforced. Additionally, the notify-multiple path now uses the full BT_GATT_PERM_READ_ENCRYPT_MASK to ensure that LE Secure Connections requirements are also applied consistently. This remediation addresses the core issue of improper attribute reference during permission evaluation while maintaining API compatibility and system functionality. The solution aligns with security best practices by ensuring that all access control decisions are made against the correct security context, preventing unauthorized data disclosure through misconfigured Bluetooth GATT characteristics.