The Hearing Access Service (HAS) GATT server in Zephyr installs a connection callback that runs security_changed() for every connection establishing security, even before the application calls bt_has_register(). Since service attribute pointers are NULL until registration, a reconnecting bonded peer during the boot window triggers notify_work_handler, which calls bt_gatt_is_subscribed() with a NULL attribute pointer. This causes an assertion failure or NULL dereference, crashing the HAS peripheral. The vulnerability requires a previously bonded peer reconnecting within the startup race window and results in a remotely triggerable denial of service. The fix adds an early check in security_changed() to return if the service is not yet registered, preventing the crash.

This vulnerability allows a remote attacker with a previously bonded Bluetooth connection to cause a denial of service by crashing the HAS peripheral during a specific boot-time window before the service is registered. There is no impact on confidentiality or integrity, and no memory corruption occurs. The denial of service can be prolonged by persistent reconnection attempts from the bonded peer.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix adds a guard in security_changed() to prevent notification work before service registration, which addresses the issue. Until an official fix is available, avoid scenarios where bonded peers reconnect during the boot-time window before bt_has_register() is called.