CVE-2026-11368

Summary of CVE-2026-11368 details: The Bluetooth host ATT layer (att.c) ties in-flight ATT TX buffers to channels via tx_meta_data_storage[]. When a buffer is freed, completion handling defers to a workqueue path (att_tx_destroy -> att_tx_destroy_work_handler -> att_on_sent_cb -> bt_att_...