CVE-2026-10685

{"id": "CVE-2026-10685", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-10685", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-31T17:46:39.697257Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "vulnerabilities@zephyrproject.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.6, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 4.7, "exploitabilityScore": 2.8}]}, "affected": [{"source": "vulnerabilities@zephyrproject.org", "affectedData": [{"vendor": "zephyrproject", "product": "zephyr", "versions": [{"status": "affected", "version": "2.4.0", "lessThan": "4.4.2", "versionType": "semver"}], "packageName": "zephyr", "programFiles": ["subsys/bluetooth/host/gatt.c"], "collectionURL": "https://github.com/zephyrproject-rtos/zephyr", "defaultStatus": "unaffected"}]}], "published": "2026-07-31T15:16:27.433", "references": [{"url": "https://github.com/zephyrproject-rtos/zephyr/commit/c7292f20223637232b6f962141725611a38f6a52", "tags": ["Patch"], "source": "vulnerabilities@zephyrproject.org"}, {"url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-29xh-jm2m-4qvx", "tags": ["Exploit", "Patch", "Vendor Advisory"], "source": "vulnerabilities@zephyrproject.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "vulnerabilities@zephyrproject.org", "description": [{"lang": "en", "value": "CWE-416"}]}], "descriptions": [{"lang": "en", "value": "The Zephyr Bluetooth GATT client CCC-write response handler gatt_write_ccc_rsp() in subsys/bluetooth/host/gatt.c invoked the application's params->subscribe() callback after it had already called params->notify(conn, params, NULL, 0).\n\nPer the public GATT API, a notify callback with NULL data is the documented signal that the subscription has terminated and the bt_gatt_subscribe_params struct may be freed or reused by the application; calling subscribe() on the struct afterwards is a use-after-free, including an indirect call through the freed params->subscribe function pointer.\n\nThe error branch is remotely (adjacent) reachable: a Zephyr device acting as a GATT client that calls bt_gatt_subscribe() can be driven into this ordering when a connected GATT server peer answers the CCC write with an ATT Error Response (the peer-supplied error code flows through att_error_rsp -> att_handle_rsp into gatt_write_ccc_rsp).\n\nFor applications that free or recycle subscription parameters in their notification-termination handler, this results in memory corruption, a crash (denial of service), or potentially attacker-influenced control flow. The fix reorders the handler so the subscribe() callback runs before the terminating notify(NULL) in both the error and unsubscribe paths."}, {"lang": "es", "value": "El gestor de respuesta de escritura CCC del cliente Zephyr Bluetooth GATT gatt_write_ccc_rsp() en subsys/bluetooth/host/gatt.c invoc\u00f3 la devoluci\u00f3n de llamada params -> subscribe() de la aplicaci\u00f3n despu\u00e9s de haber llamado ya a params -> notify(conn, params, NULL, 0).\n\nSeg\u00fan la API p\u00fablica de GATT, una devoluci\u00f3n de llamada de notificaci\u00f3n con datos NULL es la se\u00f1al documentada de que la suscripci\u00f3n ha terminado y la estructura bt_gatt_subscribe_params puede ser liberada o reutilizada por la aplicaci\u00f3n; llamar a subscribe() en la estructura despu\u00e9s es un uso despu\u00e9s de liberaci\u00f3n, incluyendo una llamada indirecta a trav\u00e9s del puntero de funci\u00f3n params -> subscribe liberado.\n\nLa rama de error es alcanzable remotamente (adyacente): un dispositivo Zephyr que act\u00faa como un cliente GATT que llama a bt_gatt_subscribe() puede ser llevado a este ordenamiento cuando un par de servidor GATT conectado responde a la escritura CCC con una Respuesta de Error ATT (el c\u00f3digo de error proporcionado por el par fluye a trav\u00e9s de att_error_rsp -> att_handle_rsp hacia gatt_write_ccc_rsp).\n\nPara aplicaciones que liberan o reciclan par\u00e1metros de suscripci\u00f3n en su gestor de terminaci\u00f3n de notificaci\u00f3n, esto resulta en corrupci\u00f3n de memoria, un fallo (denegaci\u00f3n de servicio), o un flujo de control potencialmente influenciado por el atacante. La soluci\u00f3n reordena el gestor para que la devoluci\u00f3n de llamada subscribe() se ejecute antes de la notificaci\u00f3n de terminaci\u00f3n notify(NULL) tanto en las rutas de error como de anulaci\u00f3n de suscripci\u00f3n."}], "lastModified": "2026-10-23T23:10:00.157", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:zephyrproject:zephyr:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "00A2B469-12D7-40D8-BF4A-CEFDEB9DC72A", "versionEndExcluding": "4.5.0", "versionStartIncluding": "2.4.0"}], "operator": "OR"}]}], "sourceIdentifier": "vulnerabilities@zephyrproject.org"}