CVE-2026-5068: zephyrproject-rtos zephyr Out-of-bounds Write

Vulnerability summary

CVE-2026-5068 is a high (CVSS 8.8) Out-of-bounds Write vulnerability in zephyrproject-rtos zephyr. EPSS estimates a 0.32% chance of exploitation in the next 30 days, higher than 23.9% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 09-06-2026
   PublishedVulnerability first disclosed.
2. 15-10-2026
   Last modifiedVulnerability information updated.

Description

A remote, unauthenticated BLE peer can trigger a 2-byte out-of-bounds write in the Bluetooth host during L2CAP LE CoC SDU reassembly. When the application enables segmentation (via chan_ops.alloc_buf) and the chosen RX pool has a user_data_size smaller than 2 bytes, the segmentation counter stored in the net_buf user_data area is written out of bounds in l2cap_chan_le_recv_seg (subsys/bluetooth/host/l2cap.c). The observed effects are an AddressSanitizer abort and, without ASan, heap corruption / fatal error.

• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.