Description
The Bluetooth host GATT client function parse_read_std_char_desc() in subsys/bluetooth/host/gatt.c parses an ATT Read By Type Response received from a remote GATT server during BT_GATT_DISCOVER_STD_CHAR_DESC discovery. The per-entry stride rsp->len is taken directly from the peer's PDU, and the parse loop both tests its exit condition (length >= rsp->len) and advances (length -= rsp->len, pdu += rsp->len) using that value. The minimum value of rsp->len was never validated before the loop.

A malicious or malfunctioning peer can reply with rsp->len = 0. Because length is unsigned and never decreases, the loop condition stays true forever and the read pointer never advances; as long as the body is at least a few bytes with a non-zero handle and a matching descriptor UUID, the host repeatedly re-parses the same bytes and invokes the discovery callback, never terminating. This hangs the Bluetooth host processing thread (CWE-835, loop with unreachable exit condition).

The condition is reachable by any connected peer once the local device initiates standard-descriptor-value discovery; GATT discovery does not require bonding or encryption, so an unauthenticated adjacent attacker that the device connects to can trigger it. The impact is denial of service of the Bluetooth subsystem (and likely a watchdog reset on constrained targets); there is no memory disclosure or corruption.

The fix adds a rsp->len < sizeof(struct bt_att_data) check before the loop, rejecting under-length responses so the stride is always non-zero and the loop terminates. The sibling parsers parse_include() and parse_characteristic() already validated rsp->len and are unaffected.
Published: 2026-08-13
Score: 6.5 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An infinite loop in the Zephyr Bluetooth GATT client causes the host parsing function parse_read_std_char_desc() to repeatedly re‑parse the same zero‑length response data, exhausting the Bluetooth host processing thread. The flaw is a classic loop with an unreachable exit condition (CWE‑835) and leads purely to service disruption without memory corruption or disclosure.

Affected Systems

Any Zephyr RTOS build that includes the Bluetooth host stack is affected; the vulnerability is present before the patch (the specific release series is not enumerated in the advisory). Exact version details are not supplied, but any build using the unpatched parse_read_std_char_desc() routine is vulnerable.

Risk and Exploitability

The CVSS score of 6.5 indicates a moderate severity DoS. EPSS data is not available and the flaw is not listed in the CISA KEV catalog, suggesting it is not widely exploited yet. An attacker can trigger the issue by simply connecting to the device and initiating standard‑descriptor discovery—a process that requires no bonding or encryption. The flaw can cause the Bluetooth subsystem to hang and, on constrained targets, likely trigger a watchdog reset. Because the condition is reachable for any exposed Bluetooth service, the risk remains significant for devices with no additional input validation.

Generated by OpenCVE AI on August 13, 2026 at 18:56 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Zephyr to a version that includes the patch introduced in commit 494283d4, which validates that response lengths are non‑zero before looping.
  • Rebuild and deploy the patched firmware to ensure the updated parse_read_std_char_desc() is in use.
  • If an upgrade is not immediately possible, temporarily disable or restrict Bluetooth GATT standard‑descriptor discovery on the device to prevent untrusted peers from triggering the loop.

Generated by OpenCVE AI on August 13, 2026 at 18:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 13 Aug 2026 18:45:00 +0000

Type Values Removed Values Added
First Time appeared Zephyrproject
Zephyrproject zephyr
Vendors & Products Zephyrproject
Zephyrproject zephyr

Thu, 13 Aug 2026 17:30:00 +0000

Type Values Removed Values Added
Description The Bluetooth host GATT client function parse_read_std_char_desc() in subsys/bluetooth/host/gatt.c parses an ATT Read By Type Response received from a remote GATT server during BT_GATT_DISCOVER_STD_CHAR_DESC discovery. The per-entry stride rsp->len is taken directly from the peer's PDU, and the parse loop both tests its exit condition (length >= rsp->len) and advances (length -= rsp->len, pdu += rsp->len) using that value. The minimum value of rsp->len was never validated before the loop. A malicious or malfunctioning peer can reply with rsp->len = 0. Because length is unsigned and never decreases, the loop condition stays true forever and the read pointer never advances; as long as the body is at least a few bytes with a non-zero handle and a matching descriptor UUID, the host repeatedly re-parses the same bytes and invokes the discovery callback, never terminating. This hangs the Bluetooth host processing thread (CWE-835, loop with unreachable exit condition). The condition is reachable by any connected peer once the local device initiates standard-descriptor-value discovery; GATT discovery does not require bonding or encryption, so an unauthenticated adjacent attacker that the device connects to can trigger it. The impact is denial of service of the Bluetooth subsystem (and likely a watchdog reset on constrained targets); there is no memory disclosure or corruption. The fix adds a rsp->len < sizeof(struct bt_att_data) check before the loop, rejecting under-length responses so the stride is always non-zero and the loop terminates. The sibling parsers parse_include() and parse_characteristic() already validated rsp->len and are unaffected.
Title Infinite loop (DoS) in Bluetooth GATT client parsing of Read-By-Type responses with zero data length
Weaknesses CWE-835
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Zephyrproject Zephyr
cve-icon MITRE

Status: PUBLISHED

Assigner: zephyr

Published:

Updated: 2026-08-13T17:58:32.374Z

Reserved: 2026-06-15T01:56:07.073Z

Link: CVE-2026-12236

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-13T18:17:17.017

Modified: 2026-08-13T18:17:17.017

Link: CVE-2026-12236

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-13T19:00:12Z

Weaknesses
  • CWE-835

    Loop with Unreachable Exit Condition ('Infinite Loop')