Executive brief
A vulnerability exists in the Zephyr operating system's Bluetooth audio component, which is used to manage wireless audio broadcasts. When the system is connected to multiple Bluetooth devices simultaneously, it incorrectly uses a single shared memory area to process data from all of them. A malicious or compromised Bluetooth device nearby could exploit this to corrupt the system's memory, potentially leading to a device crash or the mixing of private data between different connected users.
Technical details
The Bluetooth BAP Broadcast Assistant GATT client in `subsys/bluetooth/audio/bap_broadcast_assistant.c` utilizes a single file-static `net_buf_simple` (`att_buf`) for reassembling Broadcast Receive State data. While connection state flags are per-instance, the 512-byte buffer is shared. When connected to multiple Scan Delegators, interleaved notification and long-read callbacks can cause data from different connections to accumulate in the same buffer. Because `notify_handler` lacks a tailroom check, concurrent connections can trigger an out-of-bounds write into adjacent `.bss` memory or cause cross-connection data corruption when one connection resets the shared buffer while another's reassembly is in progress. This is exploitable by an adjacent attacker via a malicious Scan Delegator. The fix moves the buffer into the per-connection instance structure.
Affected products
- Zephyr Project Zephyr OS >= 3.6.0, <= 4.4.0
Timeline
- 2026-04-20: other: Fix authored
- 2026-05-12: patched: Fix merged to main branch
- 2026-07-11: disclosed: Advisory published