PatchSiren cyber security CVE debrief
CVE-2026-10660 Zephyr Project CVE debrief
The Bluetooth BAP Broadcast Assistant GATT client in subsys/bluetooth/audio/bap_broadcast_assistant.c reassembled remote Broadcast Receive State data into a single file-static net_buf_simple (att_buf, BT_ATT_MAX_ATTRIBUTE_LEN = 512 bytes) shared by all connection instances, while the BUSY flag, long-read handle, and reset/offset state were per-connection. When the device acts as a Broadcast Assistant connected to multiple Scan Delegator peripherals, notification and long-read callbacks from different connections interleave on the shared buffer: the append in notify_handler (net_buf_simple_add_mem at the not-busy branch) performs no tailroom check, so receive-state notifications from two or more delegators accumulate on the same 512-byte buffer and, with a sufficiently large configured ATT MTU (BT_L2CAP_TX_MTU up to 2000) and two-to-three concurrent connections, write past the buffer into adjacent .bss (net_buf_simple_add only asserts in debug builds). Even below the overflow threshold, one connection's net_buf_simple_reset zeroes the shared length while another connection's reassembly and GATT read offset are in flight, mixing one peer's data into another's parse. A malicious or compromised Scan Delegator (or two colluding peers) over BLE can trigger this, causing out-of-bounds writes (memory corruption / denial of service) and cross-connection data corruption. The fix moves the buffer into the per-connection instance struct so each connection reassembles into its own buffer. Affects Zephyr releases shipping the Broadcast Assistant with the shared buffer, including v4.4.0 and earlier.
- Vendor
- Zephyr Project
- Product
- Zephyr RTOS
- CVSS
- MEDIUM 6.4
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-07-11
- Original CVE updated
- 2026-07-11
- Advisory published
- 2026-07-11
- Advisory updated
- 2026-07-11
Who should care
Organizations using Zephyr releases with the Broadcast Assistant feature, especially those with Bluetooth Low Energy (BLE) connectivity, should be aware of this vulnerability. This includes industries relying on Zephyr-based devices for critical operations, such as automotive, industrial automation, and healthcare.
Technical summary
The Bluetooth BAP Broadcast Assistant GATT client has a buffer overflow vulnerability due to improper handling of shared buffers across multiple connections. This allows for out-of-bounds writes, leading to memory corruption and denial of service. The vulnerability is particularly concerning in environments with multiple Scan Delegator peripherals connected to a Broadcast Assistant. Affects Zephyr releases shipping the Broadcast Assistant with the shared buffer, including v4.4.0 and earlier. Organizations should review configurations for ATT MTU and concurrent connections, and consider compensating controls such as limiting the number of concurrent connections.
Defensive priority
High
Recommended defensive actions
- Apply the fix by moving the buffer into the per-connection instance struct
- Update Zephyr releases to versions that do not use the shared buffer
- Implement additional monitoring and logging to detect potential exploitation attempts
- Review and update configurations for ATT MTU and concurrent connections
- Consider compensating controls such as limiting the number of concurrent connections
Evidence notes
The CVE record was published on 2026-07-11T17:16:23.920Z and has not been modified since then. The NVD entry is currently Received. Limited information is available about the affected scope and vendor remediation efforts.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-11T17:16:23.920Z and has not been modified since then. The NVD entry is currently Received.