CVE-2026-10685

Zephyr RTOS's Bluetooth host stack contains a use-after-free (CWE-416) in the GATT client's CCC-write response handler, gatt_write_ccc_rsp() in subsys/bluetooth/host/gatt.c, which invokes the application's subscribe() callback after already calling the terminating notify(conn, params, NULL, 0) that — per the documented GATT API — signals the application may free or reuse the bt_gatt_subscribe_params struct. A device within Bluetooth range acting as a GATT server can trigger the faulty ordering simply by answering the CCC write with an ATT Error Response, whose error code flows through att_error_rsp and att_handle_rsp into gatt_write_ccc_rsp; the unsubscribe path is also affected. The result is memory corruption, a crash (denial of service), or potentially attacker-influenced control flow via an indirect call through the freed params->subscribe function pointer. Any Zephyr-based product using the Bluetooth host stack as a GATT client whose application frees or recycles subscription parameters in its notification-termination handler is affected; the affected/fixed version range is not stated in the source data, so users should consult Zephyr advisory GHSA-29xh-jm2m-4qvx. Exploitation has not been reported in the wild (EPSS 0.3%, not in CISA KEV), but a public advisory with a proof-of-concept reference is available.

What to do: Update affected Zephyr-based products to a firmware release incorporating the fix from Zephyr advisory GHSA-29xh-jm2m-4qvx, which reorders gatt_write_ccc_rsp so the subscribe() callback runs before the terminating notify(NULL) in both the error and unsubscribe paths. As an interim mitigation, applications can avoid freeing or reusing bt_gatt_subscribe_params in the notify-termination handler, and operators should contact device vendors to confirm their BLE stack includes the patch. Because exploitation requires a connected GATT-server peer within Bluetooth range, restricting connections to trusted peripherals reduces exposure.