The Zephyr Bluetooth GATT client CCC-write response handler gatt_write_ccc_rsp() in subsys/bluetooth/host/gatt.c invoked the application's params->subscribe() c…

CVE-2026-10685 describes a use-after-free vulnerability in the Zephyr RTOS Bluetooth stack, specifically in the GATT client CCC-write response handler (gatt_write_ccc_rsp()) in subsys/bluetooth/host/gatt.c. The handler incorrectly invokes the application's subscribe() callback after already calling the notify() callback with NULL data, which per the GATT API signals subscription termination and allows the bt_gatt_subscribe_params struct to be freed. This ordering bug means subscribe() may be called on already-freed memory, constituting a use-after-free. The vulnerability is remotely reachable by an adjacent Bluetooth peer acting as a GATT server that responds to a CCC write with an ATT Error Response. Exploitation can result in memory corruption, denial of service via crash, or potentially attacker-controlled code execution through a corrupted function pointer. The fix reorders callback invocations so subscribe() is called before the terminating notify(NULL) in both error and unsubscribe paths.