CVE-2026-13213
Received Received - Intake

HAS GATT Server NULL Dereference in Zephyr RTOS

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: Zephyr Project

Description
The Hearing Access Service (HAS) GATT server in subsys/bluetooth/audio/has.c installs a connection-callback set unconditionally via BT_CONN_CB_DEFINE, so security_changed() runs for every connection that establishes security even before the application has called bt_has_register(). The service attribute pointers hearing_aid_features_attr, preset_control_point_attr, and active_preset_index_attr remain NULL until bt_has_register() resolves them and sets has.registered. With CONFIG_BT_SETTINGS, settings_set_cb() restores each bonded client's persisted context at boot and unconditionally sets context->flags to BONDED_CLIENT_INIT_FLAGS (non-zero). When a previously bonded peer reconnects and re-establishes security during the startup window before bt_has_register() has been called, security_changed() sees the non-zero flags and schedules notify_work_handler, which calls bt_gatt_is_subscribed() with a still-NULL attribute pointer. That triggers an assertion (__ASSERT(attr, ...) in bt_gatt_is_subscribed()), or a NULL dereference of attr->uuid when assertions are compiled out. The result is a remotely triggerable (Bluetooth, adjacent) crash of the HAS peripheral. Exploitation requires the peer to have previously bonded with the device and to reconnect within the boot-time race window before the application registers the service; a peer that reconnects persistently can prolong the outage. Impact is denial of service only, with no memory corruption or information disclosure. The fix adds an early if (!has.registered) { return; } guard in security_changed(), so no notification work is scheduled until the GATT service is registered and its attribute pointers are valid.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-24
Last Modified
2026-08-24
Generated
2026-08-24
AI Q&A
2026-08-24
EPSS Evaluated
N/A
NVD
CVE-2026-13213
EUVD
EUVD-2026-65003

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
zephyrproject hearing_access_service *
zephyrproject zephyr From 3.6.0 (inc) to 4.4.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a race condition in the Zephyr RTOS Bluetooth Hearing Access Service (HAS) GATT server. It occurs when a previously bonded Bluetooth peer reconnects before the application registers the service. The security_changed() function runs prematurely, accessing NULL attribute pointers (hearing_aid_features_attr, preset_control_point_attr, active_preset_index_attr) which triggers a crash. The issue requires CONFIG_BT_SETTINGS enabled and a reconnection during the boot-time window before bt_has_register() is called.

Detection Guidance

This vulnerability is specific to Zephyr RTOS with Bluetooth HAS enabled and CONFIG_BT_SETTINGS configured. Detection requires checking Zephyr RTOS version and Bluetooth HAS configuration. No direct network commands detect this, but verify Zephyr version (< 4.4.2) and HAS service registration timing. Monitor for crashes during Bluetooth reconnection after boot.

Impact Analysis

The vulnerability causes a denial of service (DoS) by crashing the HAS peripheral device. This results in the device becoming unresponsive until rebooted. Exploitation requires a previously bonded peer to reconnect within a specific time window after boot, making it a localized Bluetooth attack. No memory corruption or data exposure occurs.

Compliance Impact

This vulnerability primarily impacts availability, causing service disruptions. For GDPR, it may affect the right to uninterrupted service if the device is part of a critical system. HIPAA compliance could be impacted if the device handles protected health information and becomes unavailable. The lack of memory corruption or data exposure limits broader compliance risks.

Mitigation Strategies

Upgrade Zephyr RTOS to version 4.4.2 or later. If upgrading is not possible, apply the backported fix from commit cb2329e. Ensure bt_has_register() is called before any bonded peers reconnect. Disable CONFIG_BT_SETTINGS if not required. Monitor for crashes during Bluetooth reconnection windows.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-13213. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart