Executive brief
Zephyr is an open-source operating system designed for resource-constrained devices, commonly used in IoT and embedded systems. A vulnerability in its Bluetooth audio component allows a malicious or malfunctioning nearby device to crash the system. This results in a denial of service, potentially disrupting communication or device operations for products using Zephyr's Bluetooth LE Audio features.
Technical details
A NULL pointer dereference exists in the Zephyr Bluetooth LE Audio BAP unicast client within `subsys/bluetooth/audio/bap_unicast_client.c`. The function `unicast_client_ep_qos_state()` attempts to write attacker-controlled Quality of Service (QoS) fields through the `stream->qos` pointer without verifying it is non-NULL. This pointer remains NULL for streams that have been codec-configured but not yet added to a unicast group. An attacker acting as a remote Audio Stream Control Service (ASCS) server can send a GATT notification to trigger a state transition to 'QoS Configured' during this window, leading to a system crash. The vulnerability is fixed in version 4.5.0 by ensuring QoS storage points to a valid embedded structure.
Affected products
- zephyrproject-rtos zephyr >= 4.3.0, <= 4.4.0
Timeline
- 2026-03-02: other: Fix authored
- 2026-06-23: other: Embargo date
- 2026-06-28: advisory: GHSA-22q8-m94g-2pwh published
- 2026-06-28: disclosed: CVE-2026-10593 published