CVE-2026-10593
Remotely triggerable NULL-pointer dereference in Bluetooth LE Audio BAP unicast client QoS-state handling
The Zephyr Bluetooth LE Audio Basic Audio Profile (BAP) unicast client mishandles peer-supplied ASE state notifications. In unicast_client_ep_qos_state() (subsys/bluetooth/audio/bap_unicast_client.c), the handler writes attacker-controlled QoS fields (interval, framing, phy, sdu, rtn, latency, pd) through the stream->qos pointer with only a stream != NULL guard. stream->qos is NULL for any stream that has been codec-configured via bt_bap_stream_config() but not yet added to a unicast group (it is set only by unicast_group_add_stream()). A malicious or buggy remote ASCS server, to which the local device is connected as a BAP unicast client, can send a GATT notification announcing the ASE has entered the QoS Configured state while the local endpoint is still in the Codec Configured state — a transition the dispatcher explicitly permits — during that window, causing a write through a NULL pointer and a crash (denial of service). The data written is itself remote-controlled. The defect shipped in v4.3.0 and v4.4.0 (and earlier). The fix re-points all BAP QoS storage to the always-valid embedded ep->qos struct, eliminating the NULL dereference.
Fixes and workarounds
Fix
The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.
Source: CNA: zephyrFix
The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.
Source: CNA: zephyrFix
The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.
Source: [email protected]Fix
The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.
Source: [email protected]Affected products and versions
| Product | Versions | Authority |
|---|---|---|
| zephyr zephyrproject zephyr
https://github.com/zephyrproject-rtos/zephyr |
≥ 4.3.0; < 4.5.0 (affected, semver)
Other versions: unaffected |
CNA: zephyr |
Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.
NVD applicability configurations (1)
These expressions retain AND/OR operators, negation, and required environmental products. A listed product is not sufficient to establish exposure when additional conditions apply.
[
{
"negate": false,
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zephyrproject:zephyr:*:*:*:*:*:*:*:*",
"versionEndIncluding": "4.4.1",
"versionStartIncluding": "4.3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
]CVSS assessments
| Version / score | Vector | Authority |
|---|---|---|
| 3.1 / 6.5 medium |
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | CNA: zephyr |
| 3.1 / 6.5 medium |
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | NVD: [email protected] |
Exploit evidence
References
- https://github.com/zephyrproject-rtos/zephyr/commit/52f25c903f2926cb1281b50fd79654668e2d483fCNA: zephyr · patch
- https://github.com/zephyrproject-rtos/zephyr/commit/ff26f33f35e8944230717c3bf861063050c21d73CNA: zephyr · patch
- https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-22q8-m94g-2pwhCNA: zephyr
- https://github.com/zephyrproject-rtos/zephyr/commit/52f25c903f2926cb1281b50fd79654668e2d483f[email protected] · Patch
- https://github.com/zephyrproject-rtos/zephyr/commit/ff26f33f35e8944230717c3bf861063050c21d73[email protected]
- https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-22q8-m94g-2pwh[email protected] · Exploit, Patch, Vendor Advisory
For agents and automation
Read public disclosures for free as Markdown or JSON. Compatible browsers also expose native WebMCP tools to search disclosures, read this page, and discover API access.
Use the ontology-linked Cyber API with x402 pay per request, or a Y2 Pro or Elite API key with the intel:cyber scope.
Endpoints and access details
https://api.y2.dev/api/v2/cyber/cveshttps://api.y2.dev/api/v2/cyber/cves/{cveId}
A workspace owner or admin can create a Pro or Elite API key. Send Authorization: Bearer <Y2_API_KEY> from your trusted agent runtime.
For x402, omit Authorization and read the HTTP 402 payment challenge before signing a retry. Public browser tools do not make payments.