CVE-2026-10685
HighCVSS 7.6Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
In the Zephyr Bluetooth GATT client, in the gatt_write_ccc_rsp() function, a use-after-free vulnerability exists. Upon receiving an ATT Error Response from a GATT server, the function calls the notify(NULL) callback signaling subscription termination, then calls the subscribe() callback on the already freed structure, leading to use-after-free.
Risk Assessment
An attacker within Bluetooth range can cause memory corruption, a crash (denial of service), or potentially hijack the execution flow on a Zephyr device acting as a GATT client.
Recommendation
Update Zephyr RTOS to a version containing the fix that reorders the callback invocations.
Other vulnerabilities in Zephyr
See all- CVE-2026-10772Unknown
This CVE has been rejected as a duplicate. The described vulnerability involved incorrect permission checking in the Bluetooth GATT notify/indicate paths in the Zephyr stack, but was already reported as CVE-2026-2411.
- CVE-2026-10676Unknown
CVE-2026-10676 has been withdrawn as analysis determined that the reported defect is not reachable in any released version of Zephyr. In every supported release, the affected value is corrected before use.
- CVE-2026-5067Critical
Zephyr OS has a memory corruption vulnerability in the HTTP server WebSocket upgrade path. An unauthenticated remote attacker can trigger it by sending a crafted Sec-WebSocket-Key header. The bounded copy does not guarantee NUL termination, leading to out-of-bounds read/write on stack.
- CVE-2026-13735Low
Zephyr's WireGuard implementation mishandled keepalive packets. A type-4 message with a 16-byte payload (empty plaintext plus Poly1305 tag) was accepted without tag verification because wg_process_data_message() returned early before calling wg_decrypt_packet(). An attacker could send a forged keepalive without knowing the session key.
- CVE-2026-13734Medium
Vulnerability in Zephyr's WireGuard VPN: wg_process_data_message() validated the anti-replay counter too late, after committing peer-state changes (address update, timers, key rotation). An attacker can re-inject a captured packet, leading to endpoint hijacking and session disruption.
- CVE-2026-13212High
The Zephyr virtio driver does not validate the descriptor-chain head id written by the virtio device into the used ring. A malicious virtio backend can supply an out-of-range id, causing an out-of-bounds read and invocation of an attacker-controlled function pointer in the guest's interrupt context. This enables control-flow hijacking or a reliable crash.
- CVE-2026-12634Medium
A vulnerability in the NVS backend of the Zephyr settings subsystem (settings_nvs.c) causes an out-of-bounds stack write. The nvs_read() function returns the full entry length, which can exceed the buffer size, and the code uses this value as an index for writing a NUL character, leading to a write past the buffer (CWE-787).
- CVE-2026-12632Medium
A vulnerability in Zephyr RTOS's PTP receive handler allows a remote attacker to trigger an out-of-bounds read by sending a crafted PTP packet with an invalid message type (0xE or 0xF). The lack of an upper-bound check on the msg_size[] array index leads to reading beyond the array and subsequent memory operations, potentially causing a crash or limited memory corruption.
- CVE-2026-12630Medium
Zephyr's 6LoWPAN IPHC uncompression code contains an out-of-bounds read in get_ihpc_inlined_size() (subsys/net/ip/6lo.c). The destination inline size is looked up in da_inline_size_table (13 entries) using an index built from the M, DAC and DAM bits of the IPHC dispatch word; reserved combinations 13, 14 and 15 are not bounds-checked and read past the end of the table.
- CVE-2026-12366High
A use-after-free vulnerability exists in Zephyr's dynamic kernel-object disposal path. The unref_check() function frees object storage when the reference count reaches zero, but for timers (K_OBJ_TIMER) it does not cancel the active timeout, leaving a dangling node in the global timeout queue. When the timer expires, the kernel invokes the expiration handler on freed memory, causing a write to freed heap.
Original NVD description (English source)
The Zephyr Bluetooth GATT client CCC-write response handler gatt_write_ccc_rsp() in subsys/bluetooth/host/gatt.c invoked the application's params->subscribe() callback after it had already called params->notify(conn, params, NULL, 0). Per the public GATT API, a notify callback with NULL data is the documented signal that the subscription has terminated and the bt_gatt_subscribe_params struct may be freed or reused by the application; calling subscribe() on the struct afterwards is a use-after-free, including an indirect call through the freed params->subscribe function pointer. The error branch is remotely (adjacent) reachable: a Zephyr device acting as a GATT client that calls bt_gatt_subscribe() can be driven into this ordering when a connected GATT server peer answers the CCC write with an ATT Error Response (the peer-supplied error code flows through att_error_rsp -> att_handle_rsp into gatt_write_ccc_rsp). For applications that free or recycle subscription parameters in their notification-termination handler, this results in memory corruption, a crash (denial of service), or potentially attacker-influenced control flow. The fix reorders the handler so the subscribe() callback runs before the terminating notify(NULL) in both the error and unsubscribe paths.