Zephyr RTOS CVE-2026-13213

Exploitation requires four specific conditions to be simultaneously true: (1) the target device must be running Zephyr with CONFIG_BT_HAS and CONFIG_BT_SETTINGS both enabled at build time; (2) the attacking Bluetooth peer must have previously completed a Bluetooth bond with the target device - a bond that was persisted to non-volatile storage via the settings subsystem; (3) the attacking peer must reconnect and complete Bluetooth security establishment within the boot-time race window before the application calls bt_has_register() - a window whose duration depends entirely on application startup time and is not under the attacker's control; (4) the attacker must be within Bluetooth radio range (physically adjacent). Exploitation is strictly limited to denial of service: no memory corruption, no code execution, and no information disclosure are possible. A persistent peer can extend the outage by continuously triggering crashes across reboots. Devices without CONFIG_BT_SETTINGS are not vulnerable even if CONFIG_BT_HAS is enabled.

The CVSS 3.1 vector AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H scores 5.3 Medium and accurately reflects the constraint profile. AV:A correctly requires Bluetooth physical adjacency, limiting the attacker pool to devices within radio range. AC:H reflects the race condition: the bonded peer must reconnect and complete Bluetooth security establishment within the boot window before bt_has_register() is called - a timing dependency not entirely under the attacker's control. The impact ceiling is A:H (full availability loss via crash), with C:N and I:N confirmed explicitly by the description - the tags 'Buffer Overflow' and 'Information Disclosure' appearing in the intelligence metadata are inconsistent with the actual vulnerability behavior and should be disregarded. No CISA KEV listing and no EPSS data are available, so exploitation probability cannot be quantified numerically. A persistent reconnecting peer can loop the device into repeated crashes, amplifying the practical DoS impact beyond a single reboot. Overall, this is a genuine but constrained risk: it requires Bluetooth proximity, a pre-established bond, and favorable timing - making mass exploitation implausible but targeted disruption of specific paired devices realistic.

An attacker who has previously paired a Bluetooth device with the target Zephyr HAS peripheral powers that device on near the target immediately after the target reboots. During the brief window before the target application completes bt_has_register(), the attacker's device completes BLE reconnection and Bluetooth security establishment, triggering security_changed(). The callback reads the non-zero persisted bond flags, schedules notify_work_handler, which calls bt_gatt_is_subscribed() with a NULL attribute pointer, crashing the HAS peripheral. No public exploit code has been identified; successful exploitation depends on winning the boot-time race, though a persistent attacker can repeat attempts across successive reboots to sustain the outage.