CVE-2026-85034

The Zephyr RTOS Bluetooth host's GATT client is vulnerable to an out-of-bounds write when processing Handle Value Notifications , Indications , or Multiple Handle Value Notifications . The root cause is that bt_att_recv() fails to enforce the negotiated ATT MTU, and the L2CAP channel lacks an rx....