CVE-2026-10593

Name of the Vulnerable Software and Affected Versions Zephyr versions prior to 4.3.0 Zephyr version 4.3.0 Zephyr version 4.4.0

Description The Bluetooth LE Audio Basic Audio Profile (BAP) unicast client mishandles state notifications supplied by a peer. In the unicast client ep qos state() function (subsys/bluetooth/audio/bap unicast client.c), the handler writes attacker-controlled Quality of Service (QoS) fields—including interval, framing, phy, sdu, rtn, latency, and pd—through the stream-qos pointer. Because stream-qos remains NULL for streams that have been codec-configured via bt bap stream config() but not yet added to a unicast group via unicast group add stream(), a malicious or buggy remote Audio Stream Control Service (ASCS) server can trigger a NULL pointer dereference. This occurs when the server sends a GATT notification announcing the Audio Stream Endpoint (ASE) has entered the QoS Configured state while the local endpoint is still in the Codec Configured state, resulting in a system crash and denial of service.

Recommendations Update to a version where BAP QoS storage is re-pointed to the embedded ep-qos struct to eliminate the NULL dereference for versions prior to 4.3.0, 4.3.0, and 4.4.0.