Description
The Zephyr Bluetooth GATT client CCC-write response handler gatt_write_ccc_rsp() in subsys/bluetooth/host/gatt.c invoked the application's params->subscribe() callback after it had already called params->notify(conn, params, NULL, 0).

Per the public GATT API, a notify callback with NULL data is the documented signal that the subscription has terminated and the bt_gatt_subscribe_params struct may be freed or reused by the application; calling subscribe() on the struct afterwards is a use-after-free, including an indirect call through the freed params->subscribe function pointer.

The error branch is remotely (adjacent) reachable: a Zephyr device acting as a GATT client that calls bt_gatt_subscribe() can be driven into this ordering when a connected GATT server peer answers the CCC write with an ATT Error Response (the peer-supplied error code flows through att_error_rsp -> att_handle_rsp into gatt_write_ccc_rsp).

For applications that free or recycle subscription parameters in their notification-termination handler, this results in memory corruption, a crash (denial of service), or potentially attacker-influenced control flow. The fix reorders the handler so the subscribe() callback runs before the terminating notify(NULL) in both the error and unsubscribe paths.
Published: 2026-07-31
Score: 7.6 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability occurs in Zephyr’s Bluetooth GATT client when the gatt_write_ccc_rsp() function invokes a subscribe callback after the subscribe parameters have already been freed through a preceding notify with NULL data. This use‑after‑free can corrupt memory, terminate the application, or enable an attacker to influence program control flow if the freed callback pointer is dereferenced. The flaw is a classic CWE‑416 scenario.

Affected Systems

Affected systems are devices running the Zephyr real‑time operating system that use the Bluetooth GATT client implementation. The specific product is the Zephyr Bluetooth host stack; no version range is supplied in the advisory, so all releases prior to the fix commit are potentially impacted.

Risk and Exploitability

The CVSS score of 7.6 indicates moderate‑to‑high severity. The EPSS score of less than 1% suggests that exploitation is unlikely at present, and the vulnerability is not listed in the CISA KEV catalog. The exploit can be triggered remotely by a Bluetooth GATT server that responds to a CCC write with an ATT Error Response, causing the client to execute the freed callback. Attack feasibility therefore depends on the presence of such a server and on the application logic that prematurely frees subscription parameters.

Generated by OpenCVE AI on August 3, 2026 at 09:55 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Zephyr to a release that includes the gatt_write_ccc_rsp reordering fix (committed in c7292f20223637232b6f962141725611a38f6a52).
  • If you cannot upgrade to the latest release, manually apply the patch that contains the reordering fix to gatt.c before building; this bypasses the need for a full release update.
  • If you cannot apply the patch, modify the application to postpone freeing or reusing subscription parameters until after the subscribe callback has completed; ensure the terminate notification handler does not free the params before the subscribe callback runs.

Generated by OpenCVE AI on August 3, 2026 at 09:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 31 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 31 Jul 2026 15:45:00 +0000

Type Values Removed Values Added
First Time appeared Zephyrproject
Zephyrproject zephyr
Vendors & Products Zephyrproject
Zephyrproject zephyr

Fri, 31 Jul 2026 14:45:00 +0000

Type Values Removed Values Added
Description The Zephyr Bluetooth GATT client CCC-write response handler gatt_write_ccc_rsp() in subsys/bluetooth/host/gatt.c invoked the application's params->subscribe() callback after it had already called params->notify(conn, params, NULL, 0). Per the public GATT API, a notify callback with NULL data is the documented signal that the subscription has terminated and the bt_gatt_subscribe_params struct may be freed or reused by the application; calling subscribe() on the struct afterwards is a use-after-free, including an indirect call through the freed params->subscribe function pointer. The error branch is remotely (adjacent) reachable: a Zephyr device acting as a GATT client that calls bt_gatt_subscribe() can be driven into this ordering when a connected GATT server peer answers the CCC write with an ATT Error Response (the peer-supplied error code flows through att_error_rsp -> att_handle_rsp into gatt_write_ccc_rsp). For applications that free or recycle subscription parameters in their notification-termination handler, this results in memory corruption, a crash (denial of service), or potentially attacker-influenced control flow. The fix reorders the handler so the subscribe() callback runs before the terminating notify(NULL) in both the error and unsubscribe paths.
Title Use-after-free of GATT subscribe params in Bluetooth host CCC-write response handler
Weaknesses CWE-416
References
Metrics cvssV3_1

{'score': 7.6, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H'}

Subscriptions

Zephyrproject Zephyr
cve-icon MITRE

Status: PUBLISHED

Assigner: zephyr

Published:

Updated: 2026-07-31T17:47:05.001Z

Reserved: 2026-06-02T15:26:22.870Z

Link: CVE-2026-10685

cve-icon Vulnrichment

Updated: 2026-07-31T17:46:59.040Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-31T15:16:27.433

Modified: 2026-08-07T18:59:29.510

Link: CVE-2026-10685

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T10:00:12Z

Weaknesses