CVE-2026-10593: Zephyr Bluetooth LE Audio BAP NULL Pointer DoS Vulnerability

Technical summary

CVE-2026-10593 is a NULL pointer dereference in the Zephyr Bluetooth LE Audio BAP unicast client (unicast_client_ep_qos_state() in subsys/bluetooth/audio/bap_unicast_client.c). The handler writes remote-attacker-controlled QoS parameters (interval, framing, phy, sdu, rtn, latency, pd) via stream->qos without verifying that the pointer is valid. The stream->qos field remains NULL for streams that have been codec-configured via bt_bap_stream_config() but not yet added to a unicast group (where it would normally be initialized by unicast_group_add_stream()). A remote ASCS server can trigger an out-of-order state transition—moving the ASE to QoS Configured while the local endpoint remains in Codec Configured state—which the dispatcher permits. This causes an immediate write through the NULL pointer, crashing the application. The flaw is rooted in CWE-476 (NULL pointer dereference).

Business impact

For organizations deploying Zephyr-based Bluetooth LE audio devices (e.g., hearing aids, wireless audio accessories, IoT audio endpoints), this vulnerability enables remote denial of service. A nearby attacker with Bluetooth connectivity can force a reboot or crash without authentication, disrupting service availability and user experience. In critical applications (medical devices, accessibility aids), repeated crashes degrade reliability and trust. The attack surface is limited to paired or discoverable devices, but no cryptographic trust is required—any connected peer can exploit it.

Affected systems

Zephyr RTOS versions 4.3.0, 4.4.0, and earlier versions. The vulnerability affects any Zephyr application using the Bluetooth LE Audio BAP unicast client stack, including audio peripheral devices, hearing aids, and wireless accessories built on Zephyr. Devices that do not use Bluetooth LE Audio BAP are unaffected. Verify your Zephyr version and BAP module inclusion in your build.

Exploitability

Exploitability is straightforward: an attacker with Bluetooth range and access to a vulnerable device needs only to connect and send a specially-timed GATT notification. No user interaction is required, no authentication credentials are needed, and the attack is deterministic. The barrier to exploitation is low—tools to craft GATT notifications are available, and the timing window is reliable. The CVSS score of 6.5 (Medium) reflects the availability impact (crash) without confidentiality or integrity compromise. Active exploitation is possible but not yet observed in the wild (not on the KEV list).

Remediation

Patch affected Zephyr installations by updating to a version containing the fix. The fix consolidates BAP QoS storage to use the always-valid embedded ep->qos struct instead of the dynamically-allocated stream->qos pointer, eliminating the NULL dereference. Verify the patch commit or version tag in the Zephyr repository before deploying.

Patch guidance

Check your Zephyr version (zephyr --version or VERSION file in your Zephyr installation). If you are on 4.3.0, 4.4.0, or earlier, update to the patched release specified in the Zephyr security advisory. The fix is applied in the BAP unicast client code; verify the commit hash or version bump in subsys/bluetooth/audio/ post-patch. For production devices in the field, plan a firmware update cycle. If immediate patching is not feasible, consider disabling BAP unicast client functionality or restricting Bluetooth connections to trusted peers as a temporary control.

Detection guidance

Monitor Zephyr device logs for crashes or reboots correlated with Bluetooth connections and GATT notifications. Kernel log output will typically show a NULL pointer dereference or memory fault in the audio subsystem. IDS/IPS systems listening on Bluetooth channels could flag out-of-order GATT state transitions (Codec Configured → QoS Configured without intermediate steps), though such detection is challenging without protocol-aware inspection. Maintain crash dumps and firmware version inventory to identify vulnerable deployments.

Why prioritize this

Although the CVSS score is Medium (6.5), prioritize patching based on device criticality and exposure. Medical devices, hearing aids, and accessibility aids should be prioritized for rapid patching due to reliability and safety concerns. Consumer audio devices should follow standard patch cycles. The attack requires Bluetooth proximity but no authentication, so devices in public or semi-public spaces (offices, transit, healthcare) face higher risk. Devices operated in isolated or controlled environments can defer patching slightly longer.

Risk score, explained

The CVSS v3.1 score of 6.5 reflects a Medium severity: the attack vector is adjacent (Bluetooth, AV:A), attack complexity is low (AC:L), no privileges or user interaction required (PR:N, UI:N), and the impact is scoped to availability (A:H) with no confidentiality or integrity compromise (C:N, I:N). The NULL pointer dereference leads to immediate denial of service but does not allow code execution, memory leak, or data theft. The score would be higher if remote code execution or information disclosure were possible.

Frequently asked questions