CVE-2026-2411

Zephyr's Bluetooth host performs its pre-send security check against the wrong GATT attribute: when an application passes the Characteristic Declaration (the documented, common idiom) to the notify/indicate APIs, the host checks the declaration's hard-coded read permission instead of the characteristic value's encryption/authentication/LESC requirements. A remote attacker within Bluetooth range connects, optionally without pairing or encryption, and writes the Client Characteristic Configuration descriptor to enable notifications or indications, causing the server to transmit the protected characteristic value over a link that never reached the required security level. The attacker gains read access to GATT characteristic values the application intended to expose only over an encrypted or authenticated link (information disclosure / access-control bypass, CWE-863); there is no memory-safety or availability impact. Any Zephyr-based Bluetooth device whose application restricts notify/indicate characteristic values to security permissions while the CCC descriptor is writable at a lower tier is affected, and the Notify-Multiple path additionally omitted the LE Secure Connections requirement. No in-the-wild exploitation is currently known (EPSS 0.2%, not in CISA KEV); the vendor advisory with a public reference (GHSA-4w3r-v9q9-4462) is available and a fix that resolves the value attribute before the permission check has been added to the host stack.

What to do: Upgrade Zephyr to a release containing the fix (value-attribute resolution via bt_gatt_attr_resolve_value() and the full read-encrypt mask, including LESC, on the Notify-Multiple path) — check advisory GHSA-4w3r-v9q9-4462 for patched versions. As interim mitigations, pass the characteristic value attribute (not the Characteristic Declaration) to notify/indicate calls and set the CCC descriptor's permissions to require the same security level so peers must pair/encrypt before subscribing. Audit GATT service definitions for characteristics whose values require BT_GATT_PERM_READ_ENCRYPT/AUTHEN/LESC but whose notifications or indications could be enabled by an unencrypted peer.