Zephyr Bluetooth GATT Client Vulnerability in Subscription Handling

CVE-2026-10685

What is CVE-2026-10685?

A vulnerability in the Zephyr Bluetooth GATT client arises from improper handling of subscription responses in the gatt_write_ccc_rsp() function. When an application's notify callback is triggered with NULL data, it indicates that the subscription has ended, and the subscription parameters may be released or reused. However, due to a flaw in control flow, the application's subscribe callback can be invoked on a potentially freed structure, leading to memory corruption or application crashes. This vulnerability is exploitably reachable by a GATT client responding to an invalid server request, which could result in denial of service or controlled unpredictable behavior in affected applications.

References