Executive brief
Zephyr's Hearing Access Service (HAS) Bluetooth module can be remotely crashed by a previously paired Bluetooth device that reconnects before the service is fully initialized. An attacker who has previously bonded with the device can trigger a denial of service by reconnecting during startup, causing the device to crash or become unresponsive until rebooted.
Technical details
The vulnerability is a denial of service caused by a race condition in subsys/bluetooth/audio/has.c. The HAS GATT server unconditionally registers a security callback via BT_CONN_CB_DEFINE that runs before bt_has_register() is called, and before the service's attribute pointers are initialized. When a previously bonded Bluetooth peer reconnects and re-establishes security during startup, the security_changed() callback uses NULL attribute pointers, triggering an assertion failure or NULL dereference in bt_gatt_is_subscribed(). The vulnerability requires the attacker to have previously bonded with the target device and to reconnect within the boot-time race window. No memory corruption or information disclosure occurs. The fix adds an early guard checking has.registered before scheduling notification work.
Affected products
- Zephyr Zephyr RTOS <unknown>
Timeline
- 2026-08-24: disclosed
- patched: Fix adds early guard in security_changed()