CVE-2026-10593: Remotely triggerable NULL-pointer dereference in Bluetooth LE Audio BAP unicast client QoS-state handling
The Zephyr Bluetooth LE Audio Basic Audio Profile (BAP) unicast client mishandles peer-supplied ASE state notifications. In unicastclientepqosstate() (subsys/bluetooth/audio/bapunicastclient.c), the handler writes attacker-controlled QoS fields (interval, framing, phy, sdu, rtn, latency, pd) through the stream->qos pointer with only a stream != NULL guard. stream->qos is NULL for any stream that has been codec-configured via btbapstreamconfig() but not yet added to a unicast group (it is set only by unicastgroupaddstream()).
A malicious or buggy remote ASCS server, to which the local device is connected as a BAP unicast client, can send a GATT notification announcing the ASE has entered the QoS Configured state while the local endpoint is still in the Codec Configured state — a transition the dispatcher explicitly permits — during that window, causing a write through a NULL pointer and a crash (denial of service). The data written is itself remote-controlled.
The defect shipped in v4.3.0 and v4.4.0 (and earlier). The fix re-points all BAP QoS storage to the always-valid embedded ep->qos struct, eliminating the NULL dereference.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.3.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.4.0 - Configuration
Update unicast_client_ep_qos_state() to write attacker-controlled QoS fields (interval, framing, phy, sdu, rtn, latency, pd) through the always-valid embedded endpoint QoS struct ep->qos instead of stream->qos, eliminating the NULL-pointer dereference during the permitted state transition window (Codec Configured -> QoS Configured).
Zephyr Bluetooth LE Audio BAP unicast client (subsys/bluetooth/audio/bap_unicast_client.c) BAP QoS storage pointer handling (stream->qos vs ep->qos) = Re-point QoS storage to always-valid embedded ep->qos (remove writes through stream->qos)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10593?
The severity of CVE-2026-10593 is medium with a score of 6.5.
What type of vulnerability is identified by CVE-2026-10593?
CVE-2026-10593 is classified as a null pointer dereference vulnerability.
How can CVE-2026-10593 be exploited?
CVE-2026-10593 can be exploited by sending specially crafted peer-supplied ASE state notifications to the Bluetooth LE Audio BAP unicast client.
How do I fix CVE-2026-10593?
To fix CVE-2026-10593, update to the latest version of the Zephyr Project that includes the security patch.
What impact does CVE-2026-10593 have on system security?
CVE-2026-10593 could potentially lead to a denial of service due to a null pointer dereference in the Bluetooth LE Audio BAP unicast client's QoS state handling.