CVE-2026-13213
Bluetooth HAS: NULL-pointer dereference DoS when a bonded peer reconnects before bt_has_register
Description
The Hearing Access Service (HAS) GATT server in subsys/bluetooth/audio/has.c installs a connection-callback set unconditionally via BT_CONN_CB_DEFINE, so security_changed() runs for every connection that establishes security even before the application has called bt_has_register(). The service attribute pointers hearing_aid_features_attr, preset_control_point_attr, and active_preset_index_attr remain NULL until bt_has_register() resolves them and sets has.registered. With CONFIG_BT_SETTINGS, settings_set_cb() restores each bonded client's persisted context at boot and unconditionally sets context->flags to BONDED_CLIENT_INIT_FLAGS (non-zero). When a previously bonded peer reconnects and re-establishes security during the startup window before bt_has_register() has been called, security_changed() sees the non-zero flags and schedules notify_work_handler, which calls bt_gatt_is_subscribed() with a still-NULL attribute pointer. That triggers an assertion (__ASSERT(attr, ...) in bt_gatt_is_subscribed()), or a NULL dereference of attr->uuid when assertions are compiled out. The result is a remotely triggerable (Bluetooth, adjacent) crash of the HAS peripheral. Exploitation requires the peer to have previously bonded with the device and to reconnect within the boot-time race window before the application registers the service; a peer that reconnects persistently can prolong the outage. Impact is denial of service only, with no memory corruption or information disclosure. The fix adds an early if (!has.registered) { return; } guard in security_changed(), so no notification work is scheduled until the GATT service is registered and its attribute pointers are valid.
INFO
Published Date :
Aug. 24, 2026, 6:16 p.m.
Last Modified :
Oct. 12, 2026, 3:10 p.m.
Remotely Exploit :
No
Source :
[email protected]
Affected Products
The following products are affected by CVE-2026-13213
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | MEDIUM | e2e69745-5e70-4e92-8431-deb5529a81ad | ||||
| CVSS 3.1 | MEDIUM | [email protected] | ||||
| CVSS 3.1 | MEDIUM | MITRE-CVE |
Solution
- Add an early guard to security_changed function.
- Ensure service registration before handling connection security.
- Validate attribute pointers before using them.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-13213.
| URL | Resource |
|---|---|
| https://github.com/zephyrproject-rtos/zephyr/commit/cb2329e090755abde8e57cf1c12aa2b9ca41a6a2 | |
| https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-9rj8-3fvm-cc9f |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-13213 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-13213
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-13213 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-13213 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 12, 2026
Action Type Old Value New Value Added Translation Title: zephyr de zephyrproject, Description: El servidor GATT del Servicio de Acceso Auditivo (HAS) en subsys/bluetooth/audio/has.c instala un conjunto de devolución de llamada de conexión incondicionalmente a través de BT_CONN_CB_DEFINE, por lo que security_changed() se ejecuta para cada conexión que establece seguridad incluso antes de que la aplicación haya llamado a bt_has_register(). Los punteros de atributo del servicio hearing_aid_features_attr, preset_control_point_attr y active_preset_index_attr permanecen NULL hasta que bt_has_register() los resuelve y establece has.registered. Con CONFIG_BT_SETTINGS, settings_set_cb() restaura el contexto persistente de cada cliente vinculado al arrancar y establece incondicionalmente context -> flags a BONDED_CLIENT_INIT_FLAGS (no cero). Cuando un par previamente vinculado se reconecta y restablece la seguridad durante la ventana de inicio antes de que se haya llamado a bt_has_register(), security_changed() ve los indicadores no cero y programa notify_work_handler, que llama a bt_gatt_is_subscribed() con un puntero de atributo aún NULL. Eso activa una aserción (__ASSERT(attr, ...) en bt_gatt_is_subscribed()), o una desreferencia NULL de attr -> uuid cuando las aserciones se compilan fuera. El resultado es un fallo (Bluetooth, adyacente) del periférico HAS que puede ser activado remotamente. La explotación requiere que el par se haya vinculado previamente con el dispositivo y que se reconecte dentro de la ventana de carrera de tiempo de arranque antes de que la aplicación registre el servicio; un par que se reconecta persistentemente puede prolongar la interrupción. El impacto es solo denegación de servicio, sin corrupción de memoria ni revelación de información. La solución añade una protección temprana if (!has.registered) { return; } en security_changed(), por lo que no se programa ningún trabajo de notificación hasta que el servicio GATT esté registrado y sus punteros de atributo sean válidos. -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Aug. 24, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-13213', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-08-24T20:10:28.373081Z'} -
New CVE Received by [email protected]
Aug. 24, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'zephyrproject', 'product': 'zephyr', 'versions': [{'status': 'affected', 'version': '3.6.0', 'lessThan': '4.4.2', 'versionType': 'semver'}], 'packageName': 'zephyr', 'programFiles': ['subsys/bluetooth/audio/has.c'], 'collectionURL': 'https://github.com/zephyrproject-rtos/zephyr', 'defaultStatus': 'unaffected'}] Added Description The Hearing Access Service (HAS) GATT server in subsys/bluetooth/audio/has.c installs a connection-callback set unconditionally via BT_CONN_CB_DEFINE, so security_changed() runs for every connection that establishes security even before the application has called bt_has_register(). The service attribute pointers hearing_aid_features_attr, preset_control_point_attr, and active_preset_index_attr remain NULL until bt_has_register() resolves them and sets has.registered. With CONFIG_BT_SETTINGS, settings_set_cb() restores each bonded client's persisted context at boot and unconditionally sets context->flags to BONDED_CLIENT_INIT_FLAGS (non-zero). When a previously bonded peer reconnects and re-establishes security during the startup window before bt_has_register() has been called, security_changed() sees the non-zero flags and schedules notify_work_handler, which calls bt_gatt_is_subscribed() with a still-NULL attribute pointer. That triggers an assertion (__ASSERT(attr, ...) in bt_gatt_is_subscribed()), or a NULL dereference of attr->uuid when assertions are compiled out. The result is a remotely triggerable (Bluetooth, adjacent) crash of the HAS peripheral. Exploitation requires the peer to have previously bonded with the device and to reconnect within the boot-time race window before the application registers the service; a peer that reconnects persistently can prolong the outage. Impact is denial of service only, with no memory corruption or information disclosure. The fix adds an early if (!has.registered) { return; } guard in security_changed(), so no notification work is scheduled until the GATT service is registered and its attribute pointers are valid. Added CVSS V3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Added CWE CWE-476 Added Reference https://github.com/zephyrproject-rtos/zephyr/commit/cb2329e090755abde8e57cf1c12aa2b9ca41a6a2 Added Reference https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-9rj8-3fvm-cc9f