CVE-2026-10685

Name of the Vulnerable Software and Affected Versions Zephyr (affected versions not specified)

Description In the Bluetooth GATT client, the CCC-write response handler gatt write ccc rsp() in subsys/bluetooth/host/gatt.c invokes the params->subscribe() callback after calling params->notify(conn, params, NULL, 0). According to the GATT API, a notify callback with NULL data signals that the subscription has terminated, allowing the bt gatt subscribe params struct to be freed or reused. Calling subscribe() after this event leads to a use-after-free condition, including an indirect call through the freed params->subscribe function pointer. This issue is remotely reachable when a connected GATT server peer responds to a CCC write with an ATT Error Response. For applications that recycle or free subscription parameters during notification termination, this can result in memory corruption, system crashes, or potentially attacker-influenced control flow.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.