CVE-2026-85034 Out-of-bounds write in the Bluetooth GATT client: oversized notification and indication values delivered to subscribers

The Bluetooth host's GATT client passed the value of a received Handle Value Notification, Handle Value Indication or Multiple Handle Value Notification to btgattsubscribeparams::notify callbacks using only the length derived from the received ATT PDU. btattrecv in subsys/bluetooth/host/att.c...