{"affected":[{"defaultStatus":"unaffected","ecosystem":"https://github.com/zephyrproject-rtos/zephyr","packageName":"zephyr","product":"zephyr","source":"CNA: zephyr","vendor":"zephyrproject","versions":[{"lessThan":"4.3.2","status":"affected","version":"3.6.0","versionType":"semver"},{"lessThan":"4.4.2","status":"affected","version":"4.4.0","versionType":"semver"}]}],"cveId":"CVE-2026-13213","cwes":["CWE-476"],"description":"The Hearing Access Service (HAS) GATT server in subsys/bluetooth/audio/has.c installs a connection-callback set unconditionally via BT_CONN_CB_DEFINE, so security_changed() runs for every connection that establishes security even before the application has called bt_has_register(). The service attribute pointers hearing_aid_features_attr, preset_control_point_attr, and active_preset_index_attr remain NULL until bt_has_register() resolves them and sets has.registered.\n\nWith CONFIG_BT_SETTINGS, settings_set_cb() restores each bonded client's persisted context at boot and unconditionally sets context->flags to BONDED_CLIENT_INIT_FLAGS (non-zero). When a previously bonded peer reconnects and re-establishes security during the startup window before bt_has_register() has been called, security_changed() sees the non-zero flags and schedules notify_work_handler, which calls bt_gatt_is_subscribed() with a still-NULL attribute pointer. That triggers an assertion (__ASSERT(attr, ...) in bt_gatt_is_subscribed()), or a NULL dereference of attr->uuid when assertions are compiled out.\n\nThe result is a remotely triggerable (Bluetooth, adjacent) crash of the HAS peripheral. Exploitation requires the peer to have previously bonded with the device and to reconnect within the boot-time race window before the application registers the service; a peer that reconnects persistently can prolong the outage. Impact is denial of service only, with no memory corruption or information disclosure.\n\nThe fix adds an early if (!has.registered) { return; } guard in security_changed(), so no notification work is scheduled until the GATT service is registered and its attribute pointers are valid.","epss":{"date":"2026-11-03","percentile":0.15989,"score":0.00246},"exploits":[],"kev":null,"metrics":[{"score":5.3,"severity":"medium","source":"CNA: zephyr","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},{"score":5.3,"severity":"medium","source":"NVD: vulnerabilities@zephyrproject.org","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}],"modifiedAt":1793769521340,"publishedAt":1787591437182,"references":[{"source":"CNA: zephyr","tags":["patch"],"url":"https://github.com/zephyrproject-rtos/zephyr/commit/cb2329e090755abde8e57cf1c12aa2b9ca41a6a2"},{"source":"CNA: zephyr","tags":[],"url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-9rj8-3fvm-cc9f"},{"source":"vulnerabilities@zephyrproject.org","tags":[],"url":"https://github.com/zephyrproject-rtos/zephyr/commit/cb2329e090755abde8e57cf1c12aa2b9ca41a6a2"},{"source":"vulnerabilities@zephyrproject.org","tags":[],"url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-9rj8-3fvm-cc9f"}],"remediation":[{"kind":"fix","source":"CNA: zephyr","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/zephyrproject-rtos/zephyr/commit/cb2329e090755abde8e57cf1c12aa2b9ca41a6a2"}],"revision":"0cec0f3d7ccb74870324bbae5e4e13eb3043fcc54c87e786e0ee8e1f284a0f84","sources":[{"modifiedAt":1793768392216,"name":"CNA: zephyr","retrievedAt":1793769032564,"url":"https://www.cve.org/CVERecord?id=CVE-2026-13213"},{"modifiedAt":1793769521340,"name":"NVD","retrievedAt":1793772960904,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13213"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793769048036,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-13213"}],"ssvc":{"assessedAt":1787602228373,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Bluetooth HAS: NULL-pointer dereference DoS when a bonded peer reconnects before bt_has_register","updatedAt":1793772960904}