CVE-2026-10593: Zephyr Bluetooth BAP DoS Vulnerability

CVE-2026-10593 Overview

CVE-2026-10593 is a NULL pointer dereference [CWE-476] in the Zephyr Real-Time Operating System (RTOS) Bluetooth Low Energy (LE) Audio stack. The flaw resides in the Basic Audio Profile (BAP) unicast client implementation within subsys/bluetooth/audio/bap_unicast_client.c. A malicious or malfunctioning remote Audio Stream Control Service (ASCS) server can trigger a crash on a connected BAP unicast client by sending a crafted GATT notification about an Audio Stream Endpoint (ASE) state transition. The defect affects Zephyr v4.3.0, v4.4.0, and earlier releases.

Critical Impact
An adjacent-network attacker within Bluetooth range can force the target device into a denial-of-service crash without any authentication or user interaction.

Affected Products

Zephyr RTOS v4.4.0
Zephyr RTOS v4.3.0
Zephyr RTOS releases earlier than v4.3.0 containing the affected BAP unicast client

Discovery Timeline

2026-06-28 - CVE-2026-10593 published to the National Vulnerability Database (NVD)
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-10593

Vulnerability Analysis

The Zephyr BAP unicast client handles ASE state notifications sent by a remote ASCS server over GATT. The function unicast_client_ep_qos_state() processes Quality of Service (QoS) fields supplied by the peer, including interval, framing, phy, sdu, rtn, latency, and pd. The handler writes these attacker-controlled values through the stream->qos pointer while only checking stream != NULL. The stream->qos field remains NULL for any stream that has been codec-configured via bt_bap_stream_config() but not yet added to a unicast group, because it is populated only inside unicast_group_add_stream().

The BAP dispatcher permits an ASE to transition directly from Codec Configured to QoS Configured. A remote peer can send a notification announcing that state transition while the local endpoint still has a NULLqos pointer. The subsequent field writes dereference NULL and crash the device.

Root Cause

The root cause is missing validation of the stream->qos pointer before writing peer-supplied data. QoS storage was allocated externally by the unicast group layer, creating a window where a valid stream lacks valid QoS backing memory.

Attack Vector

Exploitation requires the attacker to operate within Bluetooth LE radio range and be paired or connected to the victim device acting as a BAP unicast client. The attacker sends a crafted ASE Control Point notification that advertises the QoS Configured state. No user interaction and no authentication beyond the LE link are required.

// Patch excerpt: subsys/bluetooth/audio/ascs.c
// The fix binds stream storage to the always-valid embedded endpoint structs
	ascs_cp_rsp_success(ASE_ID(ase));

	bt_bap_stream_attach(ase->conn, stream, &ase->ep);
+	stream->codec_cfg = &ase->ep.codec_cfg;

	ascs_ep_set_state(&ase->ep, BT_BAP_EP_STATE_CODEC_CONFIGURED);

Source: Zephyr commit 52f25c9

Detection Methods for CVE-2026-10593

Indicators of Compromise

Unexpected reboots or fault handler traces on Zephyr devices operating as BAP unicast clients shortly after establishing an LE Audio connection.
Kernel fault logs referencing unicast_client_ep_qos_state or NULL address access in the Bluetooth audio subsystem.
ASE Control Point notifications received announcing a QoS Configured state while the local ASE remains in Codec Configured state.

Detection Strategies

Instrument firmware with fault handlers that capture the program counter and fault address on data aborts and forward telemetry to a device management backend.
Monitor Bluetooth Host Controller Interface (HCI) traces for GATT notifications originating from remote ASCS servers that trigger client-side resets.
Track paired LE Audio peers and alert on peers that repeatedly cause the local device to disconnect or restart the Bluetooth stack.

Monitoring Recommendations

Log the ASE state machine transitions in the BAP unicast client and forward anomalous transitions to centralized logging.
Correlate device crash counters with proximity events from paired audio accessories to identify targeted denial-of-service attempts.

How to Mitigate CVE-2026-10593

Immediate Actions Required

Update Zephyr-based firmware to a release that contains commit 52f25c9, which re-points BAP QoS storage to the always-valid embedded ep->qos struct.
Rebuild and redeploy all products acting as BAP unicast clients, including hearing aids, earbuds, and phone-side audio applications built on Zephyr.
Audit pairing lists and remove untrusted LE Audio peers on managed devices.

Patch Information

The upstream fix is available in the Zephyr repository. The patch eliminates the NULL dereference by ensuring stream->qos references the endpoint-embedded ep->qos structure once a stream is attached, so peer-supplied QoS fields always target valid storage. Review the Zephyr Security Advisory GHSA-22q8-m94g-2pwh and the upstream commit 52f25c9 for implementation details.

Workarounds

Disable the BAP unicast client role on devices that do not require LE Audio functionality until firmware can be updated.
Restrict Bluetooth LE connectivity to a bonded allowlist so unpaired remote ASCS servers cannot initiate ASE notifications.
Reduce the Bluetooth advertising and connection window in physical environments where a hostile transmitter could remain within adjacent-network range.

bash

# Configuration example: disable BAP unicast client in prj.conf until patched
CONFIG_BT_BAP_UNICAST_CLIENT=n
CONFIG_BT_AUDIO=n