The Zephyr Bluetooth GATT client contains a use-after-free vulnerability in the gatt_write_ccc_rsp() function located in subsys/bluetooth/host/gatt.c. This function improperly invokes the application's params->subscribe() callback after it has already called params->notify(conn, params, NULL, 0), which per the public GATT API signals subscription termination and allows the bt_gatt_subscribe_params struct to be freed or reused. Calling subscribe() afterward results in a use-after-free, including an indirect call through a freed function pointer. This error path can be triggered remotely when a Zephyr device acting as a GATT client receives an ATT Error Response from a connected GATT server peer during a CCC write operation. The consequence for applications that free or recycle subscription parameters in their notification-termination handler includes memory corruption, denial of service via crash, or potentially attacker-influenced control flow. The fix involves reordering the handler so that the subscribe() callback runs before the terminating notify(NULL) callback in both error and unsubscribe paths.

This vulnerability can lead to memory corruption and application crashes (denial of service) on affected Zephyr devices acting as Bluetooth GATT clients. There is also potential for attacker-influenced control flow, which could lead to further exploitation depending on the application context. The issue arises from a use-after-free condition triggered by a remote GATT server sending an ATT Error Response during subscription. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability fix involves reordering the callback invocation sequence in the gatt_write_ccc_rsp() handler. Until an official fix is available, applications should avoid freeing or recycling subscription parameters in their notification-termination handlers or implement defensive programming to prevent use-after-free conditions. Monitor the Zephyr project advisories for updates and apply official patches once released.