CVE-2026-11368 is a use-after-free vulnerability in the Zephyr RTOS Bluetooth host ATT layer (subsys/bluetooth/host/att.c). The flaw arises when a remote peer disconnects while an ATT PDU is still in-flight in the controller TX path, causing L2CAP to free the channel slab slot while deferred destroy work may still reference it via a dangling pointer. The att_on_sent_cb guard that should drop stale callbacks itself dereferences the now-freed meta->att_chan pointer. No pairing or user interaction is required; any peer with an ATT connection can trigger the bug by disconnecting during routine ATT traffic. The impact includes reliable denial-of-service via host crash and potential live memory corruption if the freed slab slot is reused. The fix nulls the att_chan field in tx_meta_data_storage[] entries before freeing the channel, so the deferred guard safely observes a NULL and drops the callback. Both teardown and destroy work run on the cooperative system workqueue, making the fix lock-free.