Bluetooth HAS GATT Server Vulnerability in Zephyr Project

CVE-2026-13213

What is CVE-2026-13213?

The Hearing Access Service (HAS) in the Zephyr Project's GATT server contains a vulnerability that can lead to a denial of service. This occurs when a bonded Bluetooth peer reconnects during a specific boot-time window before the service registers. As security callbacks are triggered for every connection, but the service attributes are not yet initialized, it results in attempts to access NULL pointers, ultimately leading to crashes. A recent fix addresses this issue by ensuring that no notifications are sent until the service is fully registered.

References