CVE-2026-13213

Name of the Vulnerable Software and Affected Versions Zephyr (affected versions not specified)

Description The Hearing Access Service (HAS) GATT server in subsys/bluetooth/audio/has.c contains a race condition during the boot process. The security changed() function is executed for every connection that establishes security, even before the application calls bt has register(). Consequently, the attribute pointers hearing aid features attr, preset control point attr, and active preset index attr remain NULL. When CONFIG BT SETTINGS is enabled, settings set cb() restores bonded client contexts, causing security changed() to schedule notify work handler. This handler then calls bt gatt is subscribed() with a NULL attribute pointer, leading to an assertion failure or a NULL pointer dereference of attr->uuid. A previously bonded peer can trigger this crash remotely via Bluetooth by reconnecting during the startup window, resulting in a denial of service.

Recommendations Update the software to a version that includes a guard in the security changed() function to ensure no notification work is scheduled until the GATT service is registered and attribute pointers are valid.