{"id":"CVE-2026-10660","summary":"Shared reassembly buffer in Bluetooth BAP Broadcast Assistant enables cross-connection memory corruption","details":"The Bluetooth BAP Broadcast Assistant GATT client in subsys/bluetooth/audio/bap_broadcast_assistant.c reassembled remote Broadcast Receive State data into a single file-static net_buf_simple (att_buf, BT_ATT_MAX_ATTRIBUTE_LEN = 512 bytes) shared by all connection instances, while the BUSY flag, long-read handle, and reset/offset state were per-connection.\n\nWhen the device acts as a Broadcast Assistant connected to multiple Scan Delegator peripherals, notification and long-read callbacks from different connections interleave on the shared buffer: the append in notify_handler (net_buf_simple_add_mem at the not-busy branch) performs no tailroom check, so receive-state notifications from two or more delegators accumulate on the same 512-byte buffer and, with a sufficiently large configured ATT MTU (BT_L2CAP_TX_MTU up to 2000) and two-to-three concurrent connections, write past the buffer into adjacent .bss (net_buf_simple_add only asserts in debug builds).\n\nEven below the overflow threshold, one connection's net_buf_simple_reset zeroes the shared length while another connection's reassembly and GATT read offset are in flight, mixing one peer's data into another's parse. A malicious or compromised Scan Delegator (or two colluding peers) over BLE can trigger this, causing out-of-bounds writes (memory corruption / denial of service) and cross-connection data corruption.\n\nThe fix moves the buffer into the per-connection instance struct so each connection reassembles into its own buffer. Affects Zephyr releases shipping the Broadcast Assistant with the shared buffer, including v4.4.0 and earlier.","aliases":["GHSA-73c7-3rh7-v5p9"],"modified":"2026-07-22T03:45:05.322560Z","published":"2026-07-11T17:00:13.644Z","database_specific":{"cwe_ids":["CWE-787"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10660.json","unresolved_ranges":[{"extracted_events":[{"introduced":"3.6.0"},{"fixed":"4.5.0"}],"source":"AFFECTED_FIELD"}],"cna_assigner":"zephyr"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10660.json"},{"type":"ADVISORY","url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-73c7-3rh7-v5p9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10660"},{"type":"FIX","url":"https://github.com/zephyrproject-rtos/zephyr/commit/0cd61589ff820b6a585c73cb36f1e14b043a2795"},{"type":"PACKAGE","url":"https://github.com/zephyrproject-rtos/zephyr"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/zephyrproject-rtos/zephyr","events":[{"introduced":"0"},{"fixed":"0cd61589ff820b6a585c73cb36f1e14b043a2795"}],"database_specific":{"source":"REFERENCES"}}],"versions":["v4.4.0","v4.4.0-rc3","v4.4.0-rc2","v4.4.0-rc1","v4.3.0","v4.3.0-rc3","v4.3.0-rc2","v4.3.0-rc1","v4.2.0","v4.2.0-rc3","v4.2.0-rc2","v4.2.0-rc1","v4.1.0","v4.1.0-rc3","v4.1.0-rc2","v4.1.0-rc1","v4.0.0","v4.0.0-rc3","v4.0.0-rc2","v4.0.0-rc1","v3.7.0","v3.7.0-rc3","v3.7.0-rc2","v3.7.0-rc1","v3.6.0","v3.6.0-rc3","v3.6.0-rc2","v3.6.0-rc1","zephyr-v3.5.0","v3.5.0","v3.5.0-rc3","v3.5.0-rc2","v3.5.0-rc1","zephyr-v3.4.0","v3.4.0","v3.4.0-rc3","v3.4.0-rc2","v3.4.0-rc1","zephyr-v3.3.0","v3.3.0","v3.3.0-rc3","v3.3.0-rc2","v3.3.0-rc1","zephyr-v3.2.0","v3.2.0","v3.2.0-rc3","v3.2.0-rc2","v3.2.0-rc1","zephyr-v3.1.0","v3.1.0","v3.1.0-rc3","v3.1.0-rc2","v3.1.0-rc1","zephyr-v3.0.0","v3.0.0","v3.0.0-rc3","v3.0.0-rc2","v3.0.0-rc1","v2.7.99","v2.7.0-rc3","v2.7.0-rc2","v2.7.0-rc1","zephyr-v2.6.0","v2.6.0","v2.6.0-rc3","v2.6.0-rc2","v2.6.0-rc1","zephyr-v2.5.0","v2.5.0","v2.5.0-rc4","v2.5.0-rc3","v2.5.0-rc2","v2.5.0-rc1","zephyr-v2.4.0","v2.4.0","v2.4.0-rc3","v2.4.0-rc2","v2.4.0-rc1","zephyr-v2.3.0","v2.3.0","v2.3.0-rc2","v2.3.0-rc1","zephyr-v2.1.0","v2.1.0","zephyr-v2.2.0","v2.2.0","v2.2.0-rc3","v2.2.0-rc2","v2.2.0-rc1","v2.1.0-rc3","v2.1.0-rc2","v2.1.0-rc1","zephyr-v2.0.0","v2.0.0","v2.0.0-rc3","v2.0.0-rc2","v2.0.0-rc1","zephyr-v1.14.0","v1.14.0","v1.14.0-rc3","v1.14.0-rc2","v1.14.0-rc1","zephyr-v1.13.0","v1.13.0","v1.13.0-rc3","v1.13.0-rc2","v1.13.0-rc1","zephyr-v1.12.0","v1.12.0","v1.12.0-rc3","v1.12.0-rc2","v1.12.0-rc1","zephyr-v1.11.0","v1.11.0","v1.11.0-rc3","v1.11.0-rc2","v1.11.0-rc1","zephyr-v1.10.0","v1.10.0","v1.10.0-rc3","v1.10.0-rc2","v1.10.0-rc1","zephyr-v1.9.0","v1.9.0","v1.9.0-rc4","v1.9.0-rc3","v1.9.0-rc2","v1.9.0-rc1","v1.8.99","zephyr-v1.5.0","v1.5.0","v1.7.99","v1.6.99","v1.5.0-rc4","v1.5.0-rc3","v1.5.0-rc2","v1.5.0-rc1","v1.5.0-rc0","zephyr-v1.4.0","v1.4.0","v1.4.0-rc3","v1.4.0-rc2","v1.4.0-rc1","zephyr-v1.3.0","v1.3.0","v1.3.0-rc2","v1.3.0-rc1","zephyr-v1.2.0","v1.2.0","v1.2.0-rc2","v1.2.0-rc1","zephyr-v1.1.0","v1.1.0","v1.1.0-rc1","zephyr-v1.0.0","v1.0.0"],"database_specific":{"vanir_signatures":[{"target":{"file":"subsys/bluetooth/audio/bap_broadcast_assistant.c"},"deprecated":false,"digest":{"line_hashes":["198158273556425829178182036869213802285","85290949569585164828366368622321942356","74776520109125187697508816437149640118","262690131748055050191012160222088826134","128933768558563957548017551813493943174","165618253691610187478868901725250712161","63183777211839762432040869511642754750","117704815985105090155694418537937693550","7265289940213195447768875630008515339","33390677157632819206632769691904322738","168653555099333714424729162629151512631","149719962797554107810532019332341442423","337437330224178429923505423210343587893","253725152341259466184088221661732390839","57890761011158538932996795065166613142","206783961087250143942521004622168850697","305256727307647414435913960974640848476","99714645917596895663225497669203327923","209403418095797597157460663453440989269","38322628842486510623506305702900186664","249420565213323932139769570714489357157","317646934766995560279690704192140674313","201826008754230770014598310406425983255","38257475363893706106965951334095807838","168176979630530764515919012336634985138","155287484730472484776671283112968898922","174053455022562609379328521505118853951","197443563551555845401887180958576974034","147390948529649553863873105958568356173","332216340517626994983169677695944953842","110678274032214733823240677963194796594","299789557886628284820880395688895345902","309358068476523790743995115921991434429","248638863236181089806078295391411012985","328308904759442305848369287377581613","324415501514635442398805538099472572455","141580261487287699799506285730414181561","323928611341812781880555563287323286529","273740604530718751518786025789166216926","67380067707057470977963127833899092055","278562236687760102965341126931895112889","80768485113735690156411917771258126260","213819291470965115682149151781200475829","293140080027419884911872762807544546229","10169846017179882875289942933786639288","295468208562421944182296255078398580889","153883527595937537494592153654958160860","238839047092991545756471531165385833599","135783565650179227966897864566582836858","227898972866479259330739187239442229908","301838404837594140274915348695608010279","214019362573842320775990686910637998091","284761036555895442511547533851552389213","115727128878168711677559048279153653047","285881206232067933810478387126701775616","283175800545178431639460197743258381582","89329801846023034689319897934333126968","87168758676423223933700566173149266555","139719281915223471650486195643894959145","316830034594498995157967701718432573085","218876171995604273002529163994648080910","63952582445743647275339659814682832670","184665986388261955039743281380704099109","259856508903595156650149052071202715937","214008935928716793628188696779577758489","38037082159250994129968453519718013962","107551051365377810144479904362260732851","195200821838530757591243595958074870224","292745083146267103862256896081363241307","271335802973656718438140148386712174157","169406636978620799765093139452020965729","36250384115216084745659419119032538702","17746123546074437854563536873848618583","143319537935104020828402286490454256103","4563849628284349290116414860169958879","308653263855625173692783596858234021071","254172278723097103842100239288287051621","122517876050224277286075228800090885752","334654843107329885864553511038158661371","290230174969179239684795223930353997320","244679880781040971073177109798455162625","247055749019173014347272218212238406870","183715868992481149353617228577960476203","183410371477830240163378005970382590132","87792693087522804412678065460257992064","195200821838530757591243595958074870224","292745083146267103862256896081363241307","103818915791768413376166237598009200627","84613342697263386354629427493751474383","30361791685450435091744041401153874868","17746123546074437854563536873848618583","143319537935104020828402286490454256103","4563849628284349290116414860169958879","308653263855625173692783596858234021071","254172278723097103842100239288287051621","122517876050224277286075228800090885752","334654843107329885864553511038158661371","290230174969179239684795223930353997320","244679880781040971073177109798455162625","247055749019173014347272218212238406870","183715868992481149353617228577960476203","164384565715786058498592870998406000182","324675798540599195352479508868606612868","195200821838530757591243595958074870224","292745083146267103862256896081363241307","120418508812673844141429191237965049352","289413698747155325509466012678502996786","218260642016309060145899319692435546177","18160932374468868273401408075328695476","47342605982818618710953740755088421179","116084528593043366245627576039830129496","42274351024236961072831527305762971809","195200821838530757591243595958074870224","292745083146267103862256896081363241307","21173231007114940714391681838284773214","149148298545294127497942039199655530594","16710623383127128802433146749979520666","81589764919428229345706543320214151454","78508227997715375055422781777718458349","289384708714096554537573502907903767833"],"threshold":0.9},"id":"CVE-2026-10660-359b4152","signature_type":"Line","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/0cd61589ff820b6a585c73cb36f1e14b043a2795"},{"id":"CVE-2026-10660-43bf7670","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/0cd61589ff820b6a585c73cb36f1e14b043a2795","target":{"file":"subsys/bluetooth/audio/bap_broadcast_assistant.c","function":"bt_bap_broadcast_assistant_scan_stop"},"deprecated":false,"digest":{"function_hash":"70860801150921563977460879371660104430","length":827}},{"deprecated":false,"digest":{"function_hash":"249463943458208292743745397191062794523","length":200},"id":"CVE-2026-10660-45cc0893","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/0cd61589ff820b6a585c73cb36f1e14b043a2795","target":{"file":"subsys/bluetooth/audio/bap_broadcast_assistant.c","function":"discover_init"}},{"signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/0cd61589ff820b6a585c73cb36f1e14b043a2795","target":{"file":"subsys/bluetooth/audio/bap_broadcast_assistant.c","function":"notify_handler"},"deprecated":false,"digest":{"function_hash":"133781233171415755470808036576245611692","length":1203},"id":"CVE-2026-10660-465a5c99","signature_type":"Function"},{"target":{"file":"subsys/bluetooth/audio/bap_broadcast_assistant.c","function":"long_bap_read"},"deprecated":false,"digest":{"function_hash":"2359625126777543740552945186749989455","length":960},"id":"CVE-2026-10660-71e1118e","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/0cd61589ff820b6a585c73cb36f1e14b043a2795"},{"id":"CVE-2026-10660-76bd4cd0","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/0cd61589ff820b6a585c73cb36f1e14b043a2795","target":{"function":"broadcast_assistant_bap_ntf_read_func","file":"subsys/bluetooth/audio/bap_broadcast_assistant.c"},"deprecated":false,"digest":{"function_hash":"11000646151836975767429865194585728083","length":1021}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/0cd61589ff820b6a585c73cb36f1e14b043a2795","target":{"file":"subsys/bluetooth/audio/bap_broadcast_assistant.c","function":"bt_bap_broadcast_assistant_add_src"},"deprecated":false,"digest":{"function_hash":"334306988708067923263242614836252200285","length":2329},"id":"CVE-2026-10660-7e0ebc8f"},{"deprecated":false,"digest":{"function_hash":"89045452542408049978489747446700410078","length":1370},"id":"CVE-2026-10660-919623b8","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/0cd61589ff820b6a585c73cb36f1e14b043a2795","target":{"file":"subsys/bluetooth/audio/bap_broadcast_assistant.c","function":"bt_bap_broadcast_assistant_scan_start"}},{"signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/0cd61589ff820b6a585c73cb36f1e14b043a2795","target":{"function":"bap_broadcast_assistant_discover_complete","file":"subsys/bluetooth/audio/bap_broadcast_assistant.c"},"deprecated":false,"digest":{"function_hash":"218282006482024331523804751073159305339","length":445},"id":"CVE-2026-10660-9a7dc4d4","signature_type":"Function"},{"id":"CVE-2026-10660-bb6915f3","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/0cd61589ff820b6a585c73cb36f1e14b043a2795","target":{"file":"subsys/bluetooth/audio/bap_broadcast_assistant.c","function":"bap_broadcast_assistant_write_cp_cb"},"deprecated":false,"digest":{"function_hash":"307507479856030782495263655852802590519","length":1140}},{"digest":{"function_hash":"88548004813246770608483726708187934887","length":2245},"id":"CVE-2026-10660-be3ca1ee","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/0cd61589ff820b6a585c73cb36f1e14b043a2795","target":{"file":"subsys/bluetooth/audio/bap_broadcast_assistant.c","function":"bt_bap_broadcast_assistant_mod_src"},"deprecated":false},{"id":"CVE-2026-10660-cfdf3b4a","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/0cd61589ff820b6a585c73cb36f1e14b043a2795","target":{"file":"subsys/bluetooth/audio/bap_broadcast_assistant.c","function":"bt_bap_broadcast_assistant_set_broadcast_code"},"deprecated":false,"digest":{"function_hash":"35318389569630825405405646618494706667","length":800}},{"source":"https://github.com/zephyrproject-rtos/zephyr/commit/0cd61589ff820b6a585c73cb36f1e14b043a2795","target":{"file":"subsys/bluetooth/audio/bap_broadcast_assistant.c","function":"bap_long_read_reset"},"deprecated":false,"digest":{"function_hash":"299214304305120660362323864262414419968","length":149},"id":"CVE-2026-10660-d8fe2ff8","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/zephyrproject-rtos/zephyr/commit/0cd61589ff820b6a585c73cb36f1e14b043a2795","target":{"file":"subsys/bluetooth/audio/bap_broadcast_assistant.c","function":"bt_bap_broadcast_assistant_rem_src"},"deprecated":false,"digest":{"function_hash":"243247886127970953097774443590757799873","length":590},"id":"CVE-2026-10660-fb491569","signature_type":"Function","signature_version":"v1"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-10660.json","vanir_signatures_modified":"2026-07-22T03:45:05Z"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H"}]}