CVE-2026-13213: Bluetooth HAS GATT Server DoS Vulnerability

CVE-2026-13213 Overview

CVE-2026-13213 is a NULL pointer dereference vulnerability in the Zephyr RTOS Hearing Access Service (HAS) GATT server implementation at subsys/bluetooth/audio/has.c. The flaw allows a previously bonded Bluetooth peer to crash the HAS peripheral by reconnecting during a boot-time race window before the application calls bt_has_register(). The connection callback registered via BT_CONN_CB_DEFINE runs unconditionally, dereferencing NULL attribute pointers when security is re-established early. Impact is limited to denial of service, with no memory corruption or information disclosure.

Critical Impact
An adjacent Bluetooth attacker with prior bonding can trigger a remote crash of the HAS peripheral during device startup, causing service outage that persistent reconnection can prolong.

Affected Products

Zephyr RTOS Bluetooth Audio subsystem (subsys/bluetooth/audio/has.c)
Hearing Access Service (HAS) GATT server implementations
Zephyr builds with CONFIG_BT_SETTINGS enabled and bonded HAS clients

Discovery Timeline

2026-08-24 - CVE-2026-13213 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-13213

Vulnerability Analysis

The HAS GATT server installs a connection callback set unconditionally through BT_CONN_CB_DEFINE. This causes security_changed() to execute for every connection that establishes security, even before the application calls bt_has_register(). The service attribute pointers hearing_aid_features_attr, preset_control_point_attr, and active_preset_index_attr remain NULL until bt_has_register() resolves them and sets has.registered.

With CONFIG_BT_SETTINGS enabled, settings_set_cb() restores each bonded client's persisted context at boot. It unconditionally sets context->flags to BONDED_CLIENT_INIT_FLAGS, a non-zero value. This creates a startup window where flags indicate an active subscription while attribute pointers remain unresolved.

Root Cause

The root cause is a missing registration check in the security callback path [CWE-476]. When a bonded peer reconnects and re-establishes security during the startup window, security_changed() observes the non-zero flags and schedules notify_work_handler. That handler calls bt_gatt_is_subscribed() with a still-NULL attribute pointer, triggering either the __ASSERT(attr, ...) assertion in bt_gatt_is_subscribed() or a NULL dereference of attr->uuid when assertions are compiled out.

Attack Vector

Exploitation requires Bluetooth adjacency and prior bonding with the target device. The attacker must reconnect within the boot-time race window before the application registers the HAS service. A peer that reconnects persistently can repeatedly trigger the crash and prolong the outage. No user interaction or elevated privileges on the target are required.

 		return;
 	}
 
+	if (!has.registered) {
+		return;
+	}
+
 	ret = bt_conn_get_info(client->conn, &info);
 	if (ret < 0) {
 		LOG_ERR("bt_conn_get_info err %d", ret);

Source: Zephyr commit cb2329e0 - the patch adds an early return in security_changed() guarding against unregistered service state.

Detection Methods for CVE-2026-13213

Indicators of Compromise

Unexpected reboots or crash logs on Zephyr-based hearing aid or HAS peripheral devices shortly after power-on.
Assertion failures referencing bt_gatt_is_subscribed() or NULL dereferences in the HAS subsystem call stack.
Repeated Bluetooth reconnection attempts from a bonded peer immediately following device boot.

Detection Strategies

Review Zephyr crash dumps and fault handlers for stack traces involving notify_work_handler and security_changed in has.c.
Correlate boot-time Bluetooth link layer events with crash timestamps to identify race-window exploitation.
Audit deployed firmware images to identify devices built from vulnerable Zephyr revisions prior to the fix commit.

Monitoring Recommendations

Aggregate device telemetry to flag peripherals experiencing repeated boot-crash cycles.
Monitor Bluetooth pairing databases for bonded peers exhibiting anomalous reconnection patterns during device startup.
Track firmware version inventory to confirm patch coverage across fleets of HAS-enabled devices.

How to Mitigate CVE-2026-13213

Immediate Actions Required

Update Zephyr source trees to include commit cb2329e0 from the Zephyr project repository and rebuild affected firmware.
Prioritize patch deployment for devices with CONFIG_BT_SETTINGS enabled and persistent bonded HAS clients.
Where feasible, defer accepting incoming Bluetooth connections until after bt_has_register() completes during boot.

Patch Information

The fix is available in the Zephyr project at commit cb2329e0. It adds an early if (!has.registered) { return; } guard in security_changed(), preventing notification work from being scheduled until the GATT service is registered and its attribute pointers are valid. Full advisory details are published in GHSA-9rj8-3fvm-cc9f.

Workarounds

Delay Bluetooth stack initialization until after the HAS service is registered by reordering application startup sequences.
Temporarily unbond untrusted peers on affected devices to prevent boot-time reconnection into the race window.
Disable CONFIG_BT_SETTINGS persistence for HAS clients if operational requirements permit, eliminating the persisted non-zero flags condition.

bash

# Update Zephyr west workspace and rebuild firmware with the fix
cd zephyrproject/zephyr
git fetch origin
git cherry-pick cb2329e090755abde8e57cf1c12aa2b9ca41a6a2
west build -b <board> samples/bluetooth/has -p always