CVE-2026-10660: Zephyr Bluetooth BAP DOS Vulnerability

CVE-2026-10660 Overview

CVE-2026-10660 is an out-of-bounds write vulnerability [CWE-787] in the Zephyr real-time operating system Bluetooth Basic Audio Profile (BAP) Broadcast Assistant GATT client. The flaw resides in subsys/bluetooth/audio/bap_broadcast_assistant.c, which reassembles remote Broadcast Receive State data into a single file-static net_buf_simple shared by all connection instances. An attacker on an adjacent Bluetooth Low Energy (BLE) network operating as a malicious Scan Delegator can trigger memory corruption and cross-connection data mixing. The vulnerability affects Zephyr v4.4.0 and earlier releases that ship the Broadcast Assistant with the shared buffer.

Critical Impact
A malicious or compromised Scan Delegator can trigger out-of-bounds writes into adjacent .bss memory, causing denial of service and cross-connection data corruption on Zephyr-based BLE devices.

Affected Products

Zephyr Project RTOS v4.4.0 and earlier
Zephyr BAP Broadcast Assistant (subsys/bluetooth/audio/bap_broadcast_assistant.c)
Embedded BLE devices built on Zephyr acting as Broadcast Assistant

Discovery Timeline

2026-07-11 - CVE-2026-10660 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-10660

Vulnerability Analysis

The Broadcast Assistant GATT client reassembles remote Broadcast Receive State data into a single file-static buffer att_buf of size BT_ATT_MAX_ATTRIBUTE_LEN (512 bytes). This buffer is shared across all connection instances, while the BUSY flag, long-read handle, and reset/offset state remain per-connection. When the device is connected to multiple Scan Delegator peripherals, notification and long-read callbacks from different connections interleave on the same buffer.

The notify_handler performs net_buf_simple_add_mem on the not-busy branch without a tailroom check. Receive-state notifications from two or more delegators accumulate on the shared 512-byte buffer. With a sufficiently large configured ATT MTU (BT_L2CAP_TX_MTU up to 2000) and two to three concurrent connections, the append writes past the buffer into adjacent .bss memory. net_buf_simple_add only asserts in debug builds, so production firmware silently corrupts memory.

Root Cause

The root cause is improper resource scoping. A single static reassembly buffer is shared across multiple concurrent BLE connections, while per-connection state tracking assumes exclusive buffer ownership. The append path also lacks a bounds check against remaining tailroom.

Attack Vector

A malicious or compromised Scan Delegator, or two colluding peers, over BLE can trigger the flaw by sending crafted Broadcast Receive State notifications while another connection's reassembly is in flight. Even below the overflow threshold, one connection's net_buf_simple_reset zeroes the shared length while another connection's GATT read offset is active, mixing one peer's data into another's parse. The upstream fix moves the buffer into the per-connection instance struct so each connection reassembles into its own buffer. Refer to the Zephyr Security Advisory GHSA-73c7-3rh7-v5p9 and the upstream commit 0cd61589 for technical details.

Detection Methods for CVE-2026-10660

Indicators of Compromise

Unexplained crashes, watchdog resets, or hard faults on Zephyr BLE devices acting as a Broadcast Assistant with multiple active Scan Delegator connections.
Corrupted or mismatched Broadcast Receive State entries reported across peers, including source addresses or BIS indices that do not match any connected delegator.
Assertion failures in debug builds originating from net_buf_simple_add within bap_broadcast_assistant.c.

Detection Strategies

Enable Zephyr debug assertions during integration testing to surface net_buf_simple tailroom violations in the Broadcast Assistant code path.
Instrument BLE stack telemetry to log ATT MTU negotiation, concurrent GATT long-read sessions, and Broadcast Receive State notification lengths per connection.
Fuzz the Broadcast Assistant GATT client with two or more simulated Scan Delegators sending overlapping notifications and long reads at high MTU values.

Monitoring Recommendations

Capture BLE HCI traces on devices deployed in multi-delegator topologies and review for interleaved notification and read-response patterns.
Track firmware versions and Zephyr release baselines across the device fleet, alerting on any deployment of v4.4.0 or earlier with BAP Broadcast Assistant enabled.
Monitor field crash telemetry for repeated faults correlated with BLE audio broadcast usage.

How to Mitigate CVE-2026-10660

Immediate Actions Required

Upgrade to a Zephyr release that includes commit 0cd61589ff820b6a585c73cb36f1e14b043a2795, which moves the reassembly buffer into the per-connection instance struct.
Inventory embedded devices using Zephyr BAP Broadcast Assistant functionality and prioritize firmware updates for products supporting multiple concurrent Scan Delegator connections.
Reduce the configured BT_L2CAP_TX_MTU where feasible to limit the size of writes that can exceed the 512-byte buffer.

Patch Information

The upstream fix is available in the Zephyr GitHub commit 0cd61589. The patch relocates att_buf from a file-static shared allocation into each per-connection bap_broadcast_assistant_instance structure so that concurrent connections no longer share reassembly state. Details are documented in the Zephyr Security Advisory GHSA-73c7-3rh7-v5p9.

Workarounds

Restrict the Broadcast Assistant to a single active Scan Delegator connection at a time until the patch is deployed.
Disable the BAP Broadcast Assistant Kconfig option on products that do not require this functionality.
Enforce pairing and bonding policies that limit connections to trusted, attested Scan Delegator peers on the adjacent BLE network.

bash

# Configuration example: disable BAP Broadcast Assistant in Zephyr prj.conf
CONFIG_BT_BAP_BROADCAST_ASSISTANT=n
# If the feature is required, cap the ATT MTU to limit oversized writes
CONFIG_BT_L2CAP_TX_MTU=247