The Hearing Access Service GATT server in Zephyr installs a connection-callback unconditionally, causing security_changed() to run for every connection established before the application registers the service. When a previously bonded peer reconnects during the boot window, security_changed() schedules notification work that accesses a NULL attribute pointer, triggering an assertion or a null dereference if assertions are disabled. This results in a remotely triggerable crash of the HAS peripheral, providing only a denial-of-service effect; there is no memory corruption or data disclosure.

Affected systems are Zephyr RTOS devices that have the Hearing Access Service enabled and rely on the CONFIG_BT_SETTINGS setting to restore bonded client contexts at boot. The problem manifests in Zephyr versions prior to the inclusion of the early guard fix added in the referenced commit.

The CVSS score of 5.3 indicates moderate severity, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the attacker to have previously bonded with the target device and to reconnect via Bluetooth within the short window that follows a device restart, during which the service has not yet registered. The attack vector is a nearby Bluetooth connection; no additional privilege or network access is needed. Once triggered, the device becomes unavailable until reboot or repair.