{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-15460 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2026-15460 yet. Limit exposure of the affected software until one is available.","what":"CVE-2026-15460 is a medium-severity missing authorization vulnerability in zephyrproject zephyr, published on 9 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-15460 and fix it if it is affected.\n\nWhat it is: CVE-2026-15460 is a medium-severity missing authorization vulnerability in zephyrproject zephyr, published on 9 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-15460 in the wild and no public exploit code.\n\nAffected product: zephyrproject zephyr. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-15460/ (Markdown: https://insights.sbomify.com/CVE-2026-15460/index.md)","id":"CVE-2026-15460","markdown":"https://insights.sbomify.com/CVE-2026-15460/index.md","name":"CVE-2026-15460","record":{"aliases":["GHSA-hx89-rm6c-hjrh"],"analysis":{"component_type":"operating_system","fix_type":"patch","impacts":["denial_of_service","other"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Zephyr Bluetooth stack","requires_auth":"none","summary":"Remote attackers can send data to unauthenticated Bluetooth channels, causing denial of service or potential memory issues due to missing state validation.","user_interaction":"not_required","vuln_class":"missing_authorization"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"zephyr","cpe":[],"cvss":{"score":5.4,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"cwes":[{"id":"CWE-666","name":"Operation on Resource in Wrong Phase of Lifetime"}],"description":"The Bluetooth Classic (BR/EDR) L2CAP receive handler bt_l2cap_br_recv() in subsys/bluetooth/host/classic/l2cap_br.c dispatched inbound data PDUs based only on the destination channel ID, without checking that the target channel had reached the BT_L2CAP_CONNECTED state. A dynamic channel is assigned its RX CID and added to the connection's channel list while still in BT_L2CAP_CONNECTING (and later BT_L2CAP_CONFIG) — before configuration completes and, for PSMs that require security, before the peer is authenticated (l2cap_br_conn_req()).\n\nBecause the channel is already findable by bt_l2cap_br_lookup_rx_cid() during this window, a remote peer within radio range can send a data PDU addressed to that CID and have it processed on a not-yet-established channel. The dispatch keys off channel fields (BR_CHAN(chan)-\u003erx.mode, rx.mps) that are only initialized during configuration by l2cap_br_conf(); since channel objects are pooled and bt_l2cap_br_chan_del() does not reset rx.mode or the reassembly buffer _sdu, a reused channel can carry stale state into the CONNECTING window and route the frame into the retransmission/flow-control path (bt_l2cap_br_ret_fc_recv()) with stale parameters and a possibly stale _sdu pointer.\n\nThe impact is delivery of attacker data to upper-layer protocol handlers on a half-open (and possibly unauthenticated) channel, plus operation on stale or partially initialized channel state on reused channel objects — leading to channel/link teardown (denial of service) and, in the stale-_sdu case, a dangling-pointer condition. The fix adds an explicit BR_CHAN(chan)-\u003estate \u003c BT_L2CAP_CONNECTED guard that drops any data received before the channel is fully connected.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":false,"headline":"Missing channel-state validation in Zephyr Bluetooth Classic L2CAP receive path","id":"CVE-2026-15460","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"missing_authorization","year":"2026"},"n_packages":0,"n_references":2,"next":{"headline":"Type confusion in Zephyr HL78xx GNSS NMEA driver causes wild-pointer write from GNSS input","id":"CVE-2026-15461"},"packages":[],"prev":{"headline":"Auth bypass in WPMU DEV Dashboard","id":"CVE-2026-15459"},"products":["zephyr"],"published":"2026-09-09","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-09-10","vendors":["zephyrproject"]},"summary":"Remote attackers can send data to unauthenticated Bluetooth channels, causing denial of service or potential memory issues due to missing state validation.","url":"https://insights.sbomify.com/CVE-2026-15460/"}