CVE-2026-10593 zephyrproject CVE debrief

Who should care

Bluetooth LE Audio BAP unicast client deployments, particularly those using Zephyr versions 4.3.0 and 4.4.0, should assess exposure and verify the fix to prevent potential denial-of-service attacks.

Why it matters

CVE-2026-10593 is a remotely triggerable NULL-pointer dereference vulnerability in the Zephyr Bluetooth LE Audio BAP unicast client. Defenders should prioritize verifying and applying the patch, assessing exposure, and verifying the fix to prevent potential denial-of-service attacks.

• Denial of service (crash) can occur due to NULL-pointer dereference.
• Verification of patch application is necessary to prevent potential attacks.
• Exposure assessment is required for Bluetooth LE Audio BAP unicast client deployments using vulnerable Zephyr versions.

Technical summary

The Zephyr Bluetooth LE Audio Basic Audio Profile (BAP) unicast client mishandles peer-supplied ASE state notifications. A malicious or buggy remote ASCS server can trigger a crash (denial of service) by sending a GATT notification announcing the ASE has entered the QoS Configured state while the local endpoint is still in the Codec Configured state. This issue arises from the client's failure to validate the ASE state notifications properly, leading to a NULL-pointer dereference. Defenders should prioritize verifying and applying the patch to prevent potential denial-of-service attacks. Bluetooth LE Audio BAP unicast client deployments should assess exposure and verify the fix.

Defensive priority

Defenders should prioritize verifying and applying the patch to prevent potential denial-of-service attacks. Bluetooth LE Audio BAP unicast client deployments should assess exposure and verify the fix.

Recommended defensive actions

• Verify and apply the patch (commit 52f25c903f2926cb1281b50fd79654668e2d483f) to prevent potential denial-of-service attacks.
• Assess exposure of Bluetooth LE Audio BAP unicast client deployments and verify the fix.
• Inventory and check systems using Zephyr versions 4.3.0 and 4.4.0 for potential vulnerability.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability is caused by the mishandling of peer-supplied ASE state notifications in the Zephyr Bluetooth LE Audio BAP unicast client. The defect shipped in v4.3.0 and v4.4.0 (and earlier). This issue was identified through code review and validation against the CVE Program record. Defenders should verify patch application and assess exposure to prevent potential denial-of-service attacks. The patch commit 52f25c903f2926cb1281b50fd79654668e2d483f addresses this vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.