{"id":"CVE-2026-10593","summary":"Remotely triggerable NULL-pointer dereference in Bluetooth LE Audio BAP unicast client QoS-state handling","details":"The Zephyr Bluetooth LE Audio Basic Audio Profile (BAP) unicast client mishandles peer-supplied ASE state notifications. In unicast_client_ep_qos_state() (subsys/bluetooth/audio/bap_unicast_client.c), the handler writes attacker-controlled QoS fields (interval, framing, phy, sdu, rtn, latency, pd) through the stream-\u003eqos pointer with only a stream != NULL guard. stream-\u003eqos is NULL for any stream that has been codec-configured via bt_bap_stream_config() but not yet added to a unicast group (it is set only by unicast_group_add_stream()).\n\nA malicious or buggy remote ASCS server, to which the local device is connected as a BAP unicast client, can send a GATT notification announcing the ASE has entered the QoS Configured state while the local endpoint is still in the Codec Configured state — a transition the dispatcher explicitly permits — during that window, causing a write through a NULL pointer and a crash (denial of service). The data written is itself remote-controlled.\n\nThe defect shipped in v4.3.0 and v4.4.0 (and earlier). The fix re-points all BAP QoS storage to the always-valid embedded ep-\u003eqos struct, eliminating the NULL dereference.","aliases":["GHSA-22q8-m94g-2pwh"],"modified":"2026-10-21T09:32:31.305696743Z","published":"2026-06-28T04:28:22.888Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10593.json","cna_assigner":"zephyr","cwe_ids":["CWE-476"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10593.json"},{"type":"ADVISORY","url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-22q8-m94g-2pwh"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10593"},{"type":"FIX","url":"https://github.com/zephyrproject-rtos/zephyr/commit/52f25c903f2926cb1281b50fd79654668e2d483f"},{"type":"PACKAGE","url":"https://github.com/zephyrproject-rtos/zephyr"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/zephyrproject-rtos/zephyr","events":[{"introduced":"3568e1b6d5cdd51a6b964a2a1d6d29200fea2056"},{"fixed":"75f67d766726351b30199f9a2bf55803d717a3be"},{"introduced":"684c9e8f32e4373a21098559f748f06915f950c9"},{"fixed":"dccb09599635bdff17633fa7e9dab014b91dce90"},{"fixed":"52f25c903f2926cb1281b50fd79654668e2d483f"}],"database_specific":{"extracted_events":[{"strategy":"StandardRange","range":[{"introduced":"4.3.0"},{"fixed":"4.3.1"}],"source":"AFFECTED_FIELD"},{"range":[{"introduced":"4.4.0"},{"fixed":"4.4.2"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"},{"range":[{"fixed":"52f25c903f2926cb1281b50fd79654668e2d483f"}],"source":"REFERENCES_COMMIT"}]}}],"versions":["v4.4.2-rc1","v4.3.1-rc1","v4.4.1","v4.4.1-rc1","v4.4.0","v4.3.0"],"database_specific":{"vanir_signatures":[{"source":"https://github.com/zephyrproject-rtos/zephyr/commit/52f25c903f2926cb1281b50fd79654668e2d483f","target":{"file":"subsys/bluetooth/audio/bap_unicast_client.c","function":"valid_unicast_group_stream_param"},"deprecated":false,"digest":{"length":1951,"function_hash":"292408892275475005120379680580256386727"},"id":"CVE-2026-10593-052f2581","signature_type":"Function","signature_version":"v1"},{"digest":{"length":1368,"function_hash":"224922821625721903791027797781266886368"},"id":"CVE-2026-10593-06681517","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/52f25c903f2926cb1281b50fd79654668e2d483f","target":{"file":"subsys/bluetooth/audio/ascs.c","function":"bt_ascs_config_ase"},"deprecated":false},{"target":{"file":"subsys/bluetooth/audio/bap_unicast_client.c","function":"unicast_group_set_iso_stream_param"},"deprecated":false,"digest":{"length":457,"function_hash":"110299230596009563911945842104369264193"},"id":"CVE-2026-10593-17d2f27c","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/52f25c903f2926cb1281b50fd79654668e2d483f"},{"source":"https://github.com/zephyrproject-rtos/zephyr/commit/52f25c903f2926cb1281b50fd79654668e2d483f","target":{"file":"subsys/bluetooth/audio/bap_unicast_client.c","function":"unicast_client_ep_qos_state"},"deprecated":false,"digest":{"function_hash":"91435995625383108888179964114311190032","length":2856},"id":"CVE-2026-10593-219266ba","signature_type":"Function","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/52f25c903f2926cb1281b50fd79654668e2d483f","target":{"function":"unicast_client_ep_config_state","file":"subsys/bluetooth/audio/bap_unicast_client.c"},"deprecated":false,"digest":{"length":2261,"function_hash":"175138635455185167732211572639428669304"},"id":"CVE-2026-10593-22daaa11"},{"digest":{"function_hash":"312496027540372537822449929228505102296","length":616},"id":"CVE-2026-10593-37d683cc","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/52f25c903f2926cb1281b50fd79654668e2d483f","target":{"file":"subsys/bluetooth/audio/bap_unicast_client.c","function":"check_and_reset_group_pd"},"deprecated":false},{"digest":{"length":697,"function_hash":"240044381095536002862836218336847588926"},"id":"CVE-2026-10593-3ca1c362","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/52f25c903f2926cb1281b50fd79654668e2d483f","target":{"file":"subsys/bluetooth/audio/bap_unicast_client.c","function":"valid_unicast_group_param"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/52f25c903f2926cb1281b50fd79654668e2d483f","target":{"file":"subsys/bluetooth/audio/bap_endpoint.h"},"deprecated":false,"digest":{"line_hashes":["20502260436559164481513110499191730677","179358946457027493159127852184346156524","227180797074905237897588126713152004508","275822084801331412963773622976354344748","138929989788595248608325235161101721993","326012527711813270360687261654552310382","145779988181697985652798883257125792688","60163225093405819715934811678371169424","303906531979366878724603984085331563532","146127030594674072202809320520369539859","317891990326839649952811367268682289849","24455350456219784556552443262440049358","204314086050300729272740153697806503778"],"threshold":0.9},"id":"CVE-2026-10593-44f50586","signature_type":"Line"},{"target":{"function":"encode_base","file":"subsys/bluetooth/audio/bap_broadcast_source.c"},"deprecated":false,"digest":{"function_hash":"8000507849983731106628466454571571513","length":574},"id":"CVE-2026-10593-4c339763","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/52f25c903f2926cb1281b50fd79654668e2d483f"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/52f25c903f2926cb1281b50fd79654668e2d483f","target":{"file":"subsys/bluetooth/audio/bap_unicast_client.c"},"deprecated":false,"digest":{"line_hashes":["249031092391459171195983166113876287480","291891378063072248480235862365663836155","41825208472769970280968415472372532915","281144376739466037374345102170452779716","25861966580531199256628030606410568867","293207905146868395986520653469787330074","226710044445291977372976509506858511739","31297082756743764178093462899763876854","220363445439605245395930032782228206572","52229165845413389671031398230130270120","30799521289132564449774545495182682177","251350444811104310634972450630347294279","141645727568878147844286513931267466469","41529737752864012283137413897463107398","5551848009136249262404289124632797561","146010789827291729949590632964903546727","213521840712540850352021584980077819613","278988917557852974078459922178413763321","100159269926081276691769513208208695737","248600134738802222371972040692502160289","121748546178317091593432880764079082639","226060946381273255800695799565536526178","307492928653566129923267847780251852134","334974104388767766604736294507799738229","188699971443252995858842529203553591201","339671786291158869320785513200068160205","11961164821502145548283832680148631928","23708088847166083170879798368600051934","67344125703825341655069739535032839424","114281711925301814710949596134920335126","280476770451101982383705110356595169956","156690783432406794159112767741152292430","7075313750975048105617699494977540150","311350006574511218443157842790633616710","227336824609960239841111529480512932968","12601586602983433971517442297714861683","74331069159884017078836215939007910411","228154930768867224477290826974000400016","38266417345964051580170944416084544329","130436027477257920422861101575499199150","36801905449017283398626612851263861920","31395421692835617986773980620129724749","145478826576261228334873697066303850274","93129990589653816768261111475709679155","277596437875278756899376382379371990889","134115117150796409658361455305320333887","268303277888910288244878110985952474088","291789461601605288937815305879717345766","155877530758896699050703683488337807148","21780907642664979255208569658333753056","26189532872139194785699929167244685889","215814365398886039323514042871015644646","174564740676945153695739232528237543229","176359661036067377118630760528362361662","78269763650700887133016006190621008626","102196719402236648587453998953830362375","197201374565838765257235884866819868185","50314029720932974123917199494259107191","50072998737603939066519802019485453583","161910168692539426349849076620415434383","263037115190411827466650332172026278413","37531550418605394716021951888945715849","334455590086369671856120212192849282569","52034397524562802217253419559752282774","213520838035978935404191268777141911482","308241154751671882466672184443701928367","49644848686792431752473989686863056062","318115315877894464212483902776134405728","10252867927326627041428270164659625044","253745038100576623879182858952287622501","215339881609604148505551889679353804630","54568585657896708782138593039029147525","196053832842168759852860948975327932225","32919509481036558665055869287532401379","255785407999088051783903032697631330625","82053620499683133879912486700643298496","219733404565186379781110655029028757922","285884607806183019908183837807609701990","273021282983216653502664715094889753791","299864062128794248393178338705884725754","322418341133751104409268407675214079308","254531317520563374362484651498213879249","197326730103852030747477616485618159199","41758223847221626552463661264688358026","337790274788899874849957068776798117812","112485613516820467250648748576845231151","255807018254777327099425220364223735930","218440038286150201465137702126460633961","113280228502963467271919352300923816491","172372849522494358212671051511823146760","157672260929820020681610850599387213369","49240603562893918416477120833703055857","150204449261655453645861889769121208713","263564436665135832106093974062699246628","312558139845692566875369570034841460612","114483486651117490064524264836558084817","195586771387620809772193967437186344382","195445761208034107540114050145327684526","276117030380076687928699986691169609845","198866006113494388002984283920809954882","132145828803381646602951387572782336157","309344917503866824300506448637309599767","104681895765821547357804183765829123089","237886474561767197757546694276528665581","339073193624255897483395284842313319402","267291009916782105027936233814903143750","137814212973961146488353927080165369444","273559419106391099814911744292678694997","239313431357201718745506659694903833029","175090019751660134140394564815985856319","55274782826272161215513074674328520559","228218664962460554137040452304702503713","200956327684134703568736450360925102942","179308890366727915081791415622083454404","119357243738783382268807965487001110581","33747591798829772326742238412475336729","298712046552969970957215295296292798213","339535171033041684306096391235722355096","193661620275664569706566730146804084826","155530096964946257612145729199751040041","139444501194486724880209536931670103115","15321661534864981729060683227256476602","24709302399388488481776133695849340469","286726564441926037565484454955387754358","27150382786727029525452298640895254500","72015717067561993324337574145233231507","263684147893749706376267494791671821964","11222576101704203760820936025347555571","192907597168145740254142618980484191591","191706428228491154734772730215238133829","333579290329267631396040806179825475167","293288658848681660915658936806539259607","99698308106718827628405387396222704073","217894570230885725121600305542593884561","108086395017800787857986467739080033071","242570784864733274945621547969957613938","179174111308060521779701678004889435251","283660561947944890168515636170736507616","309157686099761670729651169646335660841","302150761410854494037154702712453551007","177638629821914515154229976083647590256","254114082745508856654530708408194382312","208390806695500794894700625536107129691","290795393972546164822828958357562451098","25920090379353853324190393834762304045","336711777685682392125046210845373636752","289306655699277521806716103192419115671","150897858220316591405469544798319432963","28288594571792137960135933765650808470","202051834720598912679165792738442217070","323658430859455537918174232839682259232","232634988630063055113558974628978133577","170324541904356739137056159026656863503","114850256722450411346846383219764085078","203719557622239512440929193083738921399","327720027061315590699487574725227028880","120021303952886669811067731080533379007","214346121411846611907899264741663975018","25856152528224456840737154386830308772","175787867112149857877785172839522980018","282394749478924842883966936988217394022","249121182067854277551726219970027764966","122635846584161684499745264161297441135","14299187329932074769834158738974468672","11634367608896745126475653059949259019","174895831336831126139651764681175981776","68616329732455034421630456873255983513","102457152281355192371660228173708890851","250363922845388799120197204551706048076","50658556303496186217085914422909720368","305548216840239271082290071896319165519","271019148546137329111756353285007226847","114828393158620861954555848090641831836","298707457624984368197298283253564492802","35512338846954558679976000529324426657","208067827429235351281712877325375546005","24954728215188887352931883114994169419","232693201974441031176950973323074436010","179857732429432760484328318569634756287","243680124251087569305272701063010084382","275660920282070356638006120424534398954","183154736786579313216958242402243805664","300455860038590855640214513870941821050","132089478640293003943555398196591814980","328689349706637856534079987474620229339","283343385232086447877955957650748712237","332085541068178906783633283645379299733","226772234813937204363083028161885641535","178903006752557600071085717106238707378","53507158527190656158638181554782852851","187311957028039161723064715191317021079","301294722008362345183235499988090954999","319939675286602721314444826931767791682","274898611253628293721288350300428588620","304117188700533439482662114835953943644","72382580652279055766198429307868812179","337403626576744723722267823802660403539","293057359433368684924379847789134121131","57421811208094722427097779465315825488","143857676098650839757070839153943831618","319480266000965415703602691095244825394","126477180265594021949562815007602169495","231509149539058273266161451409662585399","291882233695350484473149413160352067821","301688069055089147095235276542090933725","51248578651861604748635703529551568492","39412868055946322390507727910637893212","186958508960276826362428689800837354790","14902295467216155740941221102008199015","234731731587342855429901404605934146684","199067900632117464083789010032386497062","147535427806969552944762189588819165127","325161171197591298809798095293999229962","72953452744818202085134726677614439769","176651655000938316236235407648514278297","62454779525930513974167680298184167435","312678915946339247210661391715776792650","11967475918759914306385477239211182129","184589236832403849830851022599162206575","105704198834562376776210365074352881748","313625159390324834228233500798885751285","182995388523367298331509699023568231359","264908978569660750122995445785846491560","224065574230593003390865210370045257500","318909123726007486279093197222035757669","240913050343448591581332793139715250558","110478487376659037456443272869466339081","274481278745541041596593857816033421520","36923172912522746348764839061473529209","73442784712724714044177554002179714391","52697653276675447017774674465274951379","279204239474173160607418375014250468411","117407339473173980931863319178127750593","178632967698914186628495363817415363506","106993550405586983451516057247210195454","180835624357060195082000742937146767643","326973926656459703238105488555093709404","318909123726007486279093197222035757669","260253245832933644495325604882506999827","297748885828797847683958329974909393549","334303828709151089196261213810270783","280717116415221169305757610603119206498","113374738776723428898876145273570097267","253726740203649220252812569182261939507","115385823799359867550239717568055541169","113591205864792654681217688695200230182","193661620275664569706566730146804084826","25196615122746917694162090181783217954","316998012342937226696061200978332561816","74191098232065402000993463730963689215","316170124810119135657315222497689858741","251885208686481218118817810519494975123","79633388455340578490600431793924414066","18388919737620520411190932182590854433","148238654852816849519928241532634507544","320770676471705173010225827499572683991","208644912842591066541835898160351749422"],"threshold":0.9},"id":"CVE-2026-10593-596dfa98"},{"digest":{"function_hash":"68141841652644170434697144402278005081","length":561},"id":"CVE-2026-10593-6a81bd3b","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/52f25c903f2926cb1281b50fd79654668e2d483f","target":{"function":"unicast_group_add_stream","file":"subsys/bluetooth/audio/bap_unicast_client.c"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"242052530738444543703864049523534390209","length":1070},"id":"CVE-2026-10593-7783eed9","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/52f25c903f2926cb1281b50fd79654668e2d483f","target":{"function":"broadcast_source_setup_stream","file":"subsys/bluetooth/audio/bap_broadcast_source.c"}},{"target":{"file":"subsys/bluetooth/audio/bap_stream.c","function":"bt_bap_stream_attach"},"deprecated":false,"digest":{"function_hash":"147526411263153388853772228403783185971","length":467},"id":"CVE-2026-10593-8a165cd3","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/52f25c903f2926cb1281b50fd79654668e2d483f"},{"target":{"file":"subsys/bluetooth/audio/bap_broadcast_sink.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["15785611114198168962712304044064407204","7604836438064095034428080433140653430","95446920804174600155577506162790580749","179465634232494028752608776146273874634","6914144770823801999017514173630668112","267829935149123747679020964458749724543","288864529301513199613816805805323959302","257468955499649971584173209169582481804","16520363335452183094503130196878903723","118844451259053232859229247778439915793","33668201278666620959468685126724766189","144074241851881419623208140434943575027","338934516717668323527293152663690625307","62262728476173438444857186248990732330","239038842100086853082357766822483876498","334292368177475909283609958518383035617","59856419664021017701589124111110952208","247755286199274863395344049100426467012","82287841299729100767658294238922806160","91912822323481923846030335813214472821","227335090907803876663172864069668680167","206803313373235842523490655498221754477","136526528799901447979734966861497861700","313213178252635914958174913664532787166","100660508655751445836270339368944146149","285248088825881258933567485942040490225","10284081903358065396183164952109365957","224864288965839896746099799290781189161","119956296498334621452892599931430683044","335867149433274582675197316613267611846","145202840682085120484321962560922368302","6363659587520941395967430668754908323","104483176001930516962071423159851629020","81815465848005846711946111807884878495","252164614271676420056306590954260884356","143542266016808024656084639982522999091","321118304013400937684173605681501945086","110480694681586693543704194261400318961"]},"id":"CVE-2026-10593-8b89a0ed","signature_type":"Line","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/52f25c903f2926cb1281b50fd79654668e2d483f"},{"target":{"function":"pa_decode_base","file":"subsys/bluetooth/audio/bap_broadcast_sink.c"},"deprecated":false,"digest":{"function_hash":"304723192168426355694804756461774531816","length":1281},"id":"CVE-2026-10593-8e7633ca","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/52f25c903f2926cb1281b50fd79654668e2d483f"},{"target":{"file":"subsys/bluetooth/audio/bap_broadcast_source.c"},"deprecated":false,"digest":{"line_hashes":["244185849771304534775447720560650554945","309107433654875403551822955231431198027","38865754729640296417409387597223442007","102130379413655947124246013220045014672","258502603142631689867320200977164302390","277089678094792784231758740302760774739","4281178914572544508560189154182437893","328052055834903382654282991498358651172","275573207263213536216381234572634195309","258316912539818568967191423306225005783","207811443017239012804706553544053703383","304166283261534787129604192684207217241","43233065982254894426482562698018531843","82506838993930019704931465974152613606","9492021964093140407513192449806274844","89495071229919987716005739362104998505","203733647032932312758499258640258127311","337542387574678491172707366440154052318","271781566723528305887277718517305482891","329693953784008698006726948549980396711","197802186528907593600012602212897351465","244832155836181647499652581475972578334","28533605085936090641097430612787960707","133433937647760408634500960063148203721","90901273614920419367484987047028880865","100904558321670702431401452579863577352","197027256651280538226278187587377192304","143013697601791176294872941488976199945","18282105795999656390413765217266108621","162377055059683934856090453988363074187","73776085433055290045605914076727696721","51654468886712433215502668009718076932","273564112718933358067671996586165718187","240638368986536577845826531069273070624","220386539320609126384269088649163307137","308172650227606637768626582074891971572","294471408303685335298315303980003493121","16631400248355102357344715184313311522","249865568710370205512775101617966591034","247538828546546219610027592242727416553","270617500648439021514404125904390826837","296421836822243420021193724742851776929","274778134618498921649472658986807270200","235612673997966219139215273631301557560","65560574379289775134793661177611530619","206996820826089853040471002840088001362","34689323871991408758181351884658837734","13585249967004967004548547631370049051","52560789932202087790005703506261017821","61265405138029140226237557560987531292","262096286842717010743497919108437866389","231416601626032505532643287088908758393","30036440893481867281296468389703554230"],"threshold":0.9},"id":"CVE-2026-10593-932ffe8e","signature_type":"Line","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/52f25c903f2926cb1281b50fd79654668e2d483f"},{"signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/52f25c903f2926cb1281b50fd79654668e2d483f","target":{"file":"subsys/bluetooth/audio/ascs.c","function":"ase_config"},"deprecated":false,"digest":{"function_hash":"172974542824337772998203011095783783165","length":3845},"id":"CVE-2026-10593-9971be8b","signature_type":"Function"},{"source":"https://github.com/zephyrproject-rtos/zephyr/commit/52f25c903f2926cb1281b50fd79654668e2d483f","target":{"file":"subsys/bluetooth/audio/bap_unicast_client_internal.h"},"deprecated":false,"digest":{"line_hashes":["35419430174374516837092412595157078664","37331321482691405939925550593326980701","126421087259345896305527382124687183799","140270925505248555410659412113188504640","76380179358640534156427901344915292846"],"threshold":0.9},"id":"CVE-2026-10593-a1454e58","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2026-10593-bc3dda29","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/52f25c903f2926cb1281b50fd79654668e2d483f","target":{"function":"bt_bap_broadcast_source_create","file":"subsys/bluetooth/audio/bap_broadcast_source.c"},"deprecated":false,"digest":{"length":2297,"function_hash":"275262659147568849517777134647573396403"}},{"id":"CVE-2026-10593-bc70c025","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/52f25c903f2926cb1281b50fd79654668e2d483f","target":{"function":"bt_bap_unicast_group_add_streams","file":"subsys/bluetooth/audio/bap_unicast_client.c"},"deprecated":false,"digest":{"function_hash":"288101460550439991235291985038059092462","length":1493}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/52f25c903f2926cb1281b50fd79654668e2d483f","target":{"function":"unicast_group_free","file":"subsys/bluetooth/audio/bap_unicast_client.c"},"deprecated":false,"digest":{"function_hash":"106962890250633968013823547520867158491","length":738},"id":"CVE-2026-10593-bcfec050"},{"signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/52f25c903f2926cb1281b50fd79654668e2d483f","target":{"file":"subsys/bluetooth/audio/bap_broadcast_source.c","function":"bt_bap_broadcast_source_reconfig"},"deprecated":false,"digest":{"length":1087,"function_hash":"294368737791489019753650156410885753224"},"id":"CVE-2026-10593-bfc8d89b","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/52f25c903f2926cb1281b50fd79654668e2d483f","target":{"file":"subsys/bluetooth/audio/bap_broadcast_sink.c","function":"bt_bap_broadcast_sink_sync"},"deprecated":false,"digest":{"function_hash":"106192268375125797707990248331208005792","length":3033},"id":"CVE-2026-10593-c7760aef","signature_type":"Function"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/52f25c903f2926cb1281b50fd79654668e2d483f","target":{"file":"subsys/bluetooth/audio/bap_unicast_client.c","function":"bt_bap_unicast_client_ep_qos"},"deprecated":false,"digest":{"length":1443,"function_hash":"217023857362273216733601489979901126563"},"id":"CVE-2026-10593-cf5af24c"},{"id":"CVE-2026-10593-d2b66ca2","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/52f25c903f2926cb1281b50fd79654668e2d483f","target":{"function":"biginfo_recv","file":"subsys/bluetooth/audio/bap_broadcast_sink.c"},"deprecated":false,"digest":{"function_hash":"37539929913557290564548006548007747831","length":958}},{"digest":{"line_hashes":["258505599392077846750730396510818864792","239788057802096332067437669211030979803","118850631831169331349965571469835218298","178890700300835442901629511994578584207","30905833315019048094401972101499572636","290819134147820301538509268574974105495","167360368039176210694928033990822183606","331324424974759691408889169140395114661"],"threshold":0.9},"id":"CVE-2026-10593-da98aad6","signature_type":"Line","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/52f25c903f2926cb1281b50fd79654668e2d483f","target":{"file":"subsys/bluetooth/audio/ascs.c"},"deprecated":false},{"id":"CVE-2026-10593-db03b9eb","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/52f25c903f2926cb1281b50fd79654668e2d483f","target":{"file":"subsys/bluetooth/audio/bap_unicast_client.c","function":"bt_bap_unicast_client_qos"},"deprecated":false,"digest":{"length":3316,"function_hash":"132956362477801225342452612301468540728"}},{"id":"CVE-2026-10593-e5c043d0","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/52f25c903f2926cb1281b50fd79654668e2d483f","target":{"file":"subsys/bluetooth/audio/bap_broadcast_source.c","function":"bt_bap_broadcast_source_start"},"deprecated":false,"digest":{"function_hash":"26369661463743095394322886025718703494","length":1470}},{"deprecated":false,"digest":{"length":447,"function_hash":"276676023089982384854097888541484610998"},"id":"CVE-2026-10593-e93e1184","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/52f25c903f2926cb1281b50fd79654668e2d483f","target":{"file":"subsys/bluetooth/audio/bap_unicast_client.c","function":"valid_group_stream_pair_param"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/52f25c903f2926cb1281b50fd79654668e2d483f","target":{"function":"audio_stream_qos_cleanup","file":"subsys/bluetooth/audio/bap_unicast_client.c"},"deprecated":false,"digest":{"function_hash":"56693518393746691178344445386720971080","length":277},"id":"CVE-2026-10593-eb8e7074"},{"deprecated":false,"digest":{"function_hash":"101909837589810075534167013678534102695","length":866},"id":"CVE-2026-10593-ee56de35","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/52f25c903f2926cb1281b50fd79654668e2d483f","target":{"file":"subsys/bluetooth/audio/bap_broadcast_sink.c","function":"bt_bap_broadcast_sink_setup_stream"}},{"deprecated":false,"digest":{"line_hashes":["1344539733756400957064173497624227510","245629049911049243587477357658477305890","221063303274916576835477285530138601635","203876829337651799493472031934374146791"],"threshold":0.9},"id":"CVE-2026-10593-f187afc2","signature_type":"Line","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/52f25c903f2926cb1281b50fd79654668e2d483f","target":{"file":"subsys/bluetooth/audio/bap_stream.c"}}],"vanir_signatures_modified":"2026-10-21T09:32:31Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-10593.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}