CVE-2026-10685
- Source
- https://cve.org/CVERecord?id=CVE-2026-10685
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-10685.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-10685
- Aliases
-
- GHSA-29xh-jm2m-4qvx
- Published
- 2026-07-31T14:41:47.259Z
- Modified
- 2026-08-02T09:08:09.314484Z
- Severity
-
- 7.6 (High) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H CVSS Calculator
- Summary
- Use-after-free of GATT subscribe params in Bluetooth host CCC-write response handler
- Details
-
The Zephyr Bluetooth GATT client CCC-write response handler gattwriteccc_rsp() in subsys/bluetooth/host/gatt.c invoked the application's params->subscribe() callback after it had already called params->notify(conn, params, NULL, 0).
Per the public GATT API, a notify callback with NULL data is the documented signal that the subscription has terminated and the btgattsubscribe_params struct may be freed or reused by the application; calling subscribe() on the struct afterwards is a use-after-free, including an indirect call through the freed params->subscribe function pointer.
The error branch is remotely (adjacent) reachable: a Zephyr device acting as a GATT client that calls btgattsubscribe() can be driven into this ordering when a connected GATT server peer answers the CCC write with an ATT Error Response (the peer-supplied error code flows through atterrorrsp -> atthandlersp into gattwriteccc_rsp).
For applications that free or recycle subscription parameters in their notification-termination handler, this results in memory corruption, a crash (denial of service), or potentially attacker-influenced control flow. The fix reorders the handler so the subscribe() callback runs before the terminating notify(NULL) in both the error and unsubscribe paths.
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10685.json", "unresolved_ranges": [ { "source": "AFFECTED_FIELD", "extracted_events": [ { "introduced": "2.4.0" }, { "fixed": "4.5.0" } ] } ], "cna_assigner": "zephyr", "cwe_ids": [ "CWE-416" ] }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10685.json
- https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-29xh-jm2m-4qvx
- https://nvd.nist.gov/vuln/detail/CVE-2026-10685
- https://github.com/zephyrproject-rtos/zephyr/commit/c7292f20223637232b6f962141725611a38f6a52
- https://github.com/zephyrproject-rtos/zephyr
Affected packages
Git / github.com/zephyrproject-rtos/zephyr
Affected versions
v1.*
v2.*
v3.*
v4.*
zephyr-v1.*
zephyr-v2.*
zephyr-v3.*
Database specific
vanir_signatures_modified
"2026-08-02T09:08:09Z"
vanir_signatures
[
{
"id": "CVE-2026-10685-58fbdd9c",
"signature_version": "v1",
"digest": {
"function_hash": "188504625080517330644709503773947935442",
"length": 692.0
},
"signature_type": "Function",
"target": {
"function": "gatt_write_ccc_rsp",
"file": "subsys/bluetooth/host/gatt.c"
},
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/c7292f20223637232b6f962141725611a38f6a52",
"deprecated": false
},
{
"id": "CVE-2026-10685-91cdbd68",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"101894991984300739520013795372067710863",
"205665838779173324668220640911087060189",
"92588117514821852197641931972177857670",
"316193155982533894754703338866724310842",
"129944733633148053419981157265327353452",
"151942286689618930553032507099776931935",
"55221366889224846258147979426128087746",
"320958147066202171372462160753769835400",
"234194702923274434607000747838759527221",
"169265812297538581433105953923541757738",
"6139597401392241032609420326759402777",
"179318561895665922052474761837493210009"
]
},
"signature_type": "Line",
"target": {
"file": "subsys/bluetooth/host/gatt.c"
},
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/c7292f20223637232b6f962141725611a38f6a52",
"deprecated": false
}
]
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-10685.json"