{"id":"CVE-2026-13213","summary":"Bluetooth HAS: NULL-pointer dereference DoS when a bonded peer reconnects before bt_has_register","details":"The Hearing Access Service (HAS) GATT server in subsys/bluetooth/audio/has.c installs a connection-callback set unconditionally via BT_CONN_CB_DEFINE, so security_changed() runs for every connection that establishes security even before the application has called bt_has_register(). The service attribute pointers hearing_aid_features_attr, preset_control_point_attr, and active_preset_index_attr remain NULL until bt_has_register() resolves them and sets has.registered.\n\nWith CONFIG_BT_SETTINGS, settings_set_cb() restores each bonded client's persisted context at boot and unconditionally sets context-\u003eflags to BONDED_CLIENT_INIT_FLAGS (non-zero). When a previously bonded peer reconnects and re-establishes security during the startup window before bt_has_register() has been called, security_changed() sees the non-zero flags and schedules notify_work_handler, which calls bt_gatt_is_subscribed() with a still-NULL attribute pointer. That triggers an assertion (__ASSERT(attr, ...) in bt_gatt_is_subscribed()), or a NULL dereference of attr-\u003euuid when assertions are compiled out.\n\nThe result is a remotely triggerable (Bluetooth, adjacent) crash of the HAS peripheral. Exploitation requires the peer to have previously bonded with the device and to reconnect within the boot-time race window before the application registers the service; a peer that reconnects persistently can prolong the outage. Impact is denial of service only, with no memory corruption or information disclosure.\n\nThe fix adds an early if (!has.registered) { return; } guard in security_changed(), so no notification work is scheduled until the GATT service is registered and its attribute pointers are valid.","aliases":["GHSA-9rj8-3fvm-cc9f"],"modified":"2026-08-28T14:32:48.843633Z","published":"2026-08-24T17:10:37.182Z","database_specific":{"cwe_ids":["CWE-476"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/13xxx/CVE-2026-13213.json","cna_assigner":"zephyr"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/13xxx/CVE-2026-13213.json"},{"type":"ADVISORY","url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-9rj8-3fvm-cc9f"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13213"},{"type":"FIX","url":"https://github.com/zephyrproject-rtos/zephyr/commit/cb2329e090755abde8e57cf1c12aa2b9ca41a6a2"},{"type":"PACKAGE","url":"https://github.com/zephyrproject-rtos/zephyr"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/zephyrproject-rtos/zephyr","events":[{"introduced":"468eb56cf242eedba62006ee758700ee6148763f"},{"fixed":"cb2329e090755abde8e57cf1c12aa2b9ca41a6a2"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"3.6.0"},{"fixed":"4.4.2"}]}}],"versions":["v4.4.0","v4.4.0-rc3","v4.4.0-rc2","v4.4.0-rc1","v4.3.0","v4.3.0-rc3","v4.3.0-rc2","v4.3.0-rc1","v4.2.0","v4.2.0-rc3","v4.2.0-rc2","v4.2.0-rc1","v4.1.0","v4.1.0-rc3","v4.1.0-rc2","v4.1.0-rc1","v4.0.0","v4.0.0-rc3","v4.0.0-rc2","v4.0.0-rc1","v3.7.0","v3.7.0-rc3","v3.7.0-rc2","v3.7.0-rc1","v3.6.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-13213.json","vanir_signatures_modified":"2026-08-28T14:32:48Z","vanir_signatures":[{"digest":{"function_hash":"216433227156822690243193170377400733016","length":610},"id":"CVE-2026-13213-7222c3a2","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/cb2329e090755abde8e57cf1c12aa2b9ca41a6a2","target":{"function":"security_changed","file":"subsys/bluetooth/audio/has.c"},"deprecated":false},{"source":"https://github.com/zephyrproject-rtos/zephyr/commit/cb2329e090755abde8e57cf1c12aa2b9ca41a6a2","target":{"file":"subsys/bluetooth/audio/has.c"},"deprecated":false,"digest":{"line_hashes":["255649191392224227065097807715515739059","10975132733497831873251524758184240232","25155388864762324376281974614834376625"],"threshold":0.9},"id":"CVE-2026-13213-e33d872a","signature_type":"Line","signature_version":"v1"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}