CVE-2026-13213 zephyrproject CVE debrief

Who should care

Bluetooth device manufacturers and developers who use the Zephyr RTOS and have implemented the HAS GATT service should assess their exposure and apply the provided patch to prevent remotely triggerable denial-of-service attacks.

Why it matters

A remotely triggerable denial-of-service vulnerability exists in the Hearing Access Service (HAS) GATT server implementation. An attacker who has previously bonded with the device can trigger a crash by reconnecting within a specific time window before the application registers the service. Bluetooth device manufacturers and developers who use the Zephyr RTOS and have implemented the HAS GATT service should assess their exposure and apply the provided patch to prevent remotely triggerable denial-of-service attacks.

• Denial of service: an attacker can trigger a crash of the HAS peripheral
• Verification priority: review and apply the provided patch to fix the vulnerability
• Exposure assessment: verify that the application registers the HAS GATT service before allowing connections from previously bonded peers

Technical summary

The Hearing Access Service (HAS) GATT server in subsys/bluetooth/audio/has.c installs a connection-callback set unconditionally via BT_CONN_CB_DEFINE, so security_changed() runs for every connection that establishes security even before the application has called bt_has_register(). The service attribute pointers hearing_aid_features_attr, preset_control_point_attr, and active_preset_index_attr remain NULL until bt_has_register() resolves them and sets has.registered. With CONFIG_BT_SETTINGS, settings_set_cb() restores each bonded client's persisted context at boot and unconditionally sets context->flags to BONDED_CLIENT_INIT_FLAGS (non-zero). When a previously bonded peer reconnects and re-establishes security,

Defensive priority

Medium

Recommended defensive actions

• Review and apply the provided patch to fix the vulnerability
• Verify that the application registers the HAS GATT service before allowing connections from previously bonded peers
• Monitor for and limit connections from untrusted peers
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is caused by the unconditional installation of a connection-callback in the HAS GATT server, which can lead to a NULL pointer dereference when a previously bonded peer reconnects and re-establishes security during the startup window.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.