From 6a31c71daf24281f6586ef1d16a01be8c8871138 Mon Sep 17 00:00:00 2001 From: Astha Verma Date: Mon, 30 Mar 2026 12:12:59 +0530 Subject: [PATCH 1/6] fix(nimble): fix null dereference of ble_gatts_conn_aware_states after gatts stop --- components/bt/host/nimble/nimble | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/components/bt/host/nimble/nimble b/components/bt/host/nimble/nimble index 23bfcada3e7..b683865655b 160000 --- a/components/bt/host/nimble/nimble +++ b/components/bt/host/nimble/nimble @@ -1 +1 @@ -Subproject commit 23bfcada3e7719d4c3817e949d05751ac2cf72b3 +Subproject commit b683865655bc99dc35ac40b238dbd63f3086a632 From 046e3f7d5da38f8c09f5bd8d8c21e766cb81838e Mon Sep 17 00:00:00 2001 From: Rahul Tank Date: Tue, 7 Apr 2026 14:56:00 +0530 Subject: [PATCH 2/6] fix(nimble): Fix DTM test end packet count parsing --- components/bt/host/nimble/nimble | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/components/bt/host/nimble/nimble b/components/bt/host/nimble/nimble index b683865655b..5255b4ba604 160000 --- a/components/bt/host/nimble/nimble +++ b/components/bt/host/nimble/nimble @@ -1 +1 @@ -Subproject commit b683865655bc99dc35ac40b238dbd63f3086a632 +Subproject commit 5255b4ba604ab75e1c87d24dcb2cac321a9d5bdb From 44c159b44067b92b9f7fec7b42f70a3e92d30a4c Mon Sep 17 00:00:00 2001 From: Rahul Tank Date: Tue, 31 Mar 2026 17:15:07 +0530 Subject: [PATCH 3/6] fix(nimble): Resolve host lock assert in DEBUG mode --- components/bt/host/nimble/nimble | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/components/bt/host/nimble/nimble b/components/bt/host/nimble/nimble index 5255b4ba604..e934bb10bc0 160000 --- a/components/bt/host/nimble/nimble +++ b/components/bt/host/nimble/nimble @@ -1 +1 @@ -Subproject commit 5255b4ba604ab75e1c87d24dcb2cac321a9d5bdb +Subproject commit e934bb10bc041e44b7d4ed812819d8f2a9d87a03 From 9c5c3a33efb6896573352c3ae9ad43e6b5cbe554 Mon Sep 17 00:00:00 2001 From: Rahul Tank Date: Wed, 8 Apr 2026 14:14:44 +0530 Subject: [PATCH 4/6] fix(nimble): Fix prox service to handle negative values --- components/bt/host/nimble/nimble | 2 +- .../proximity_sensor_cent/main/main.c | 19 +++---------------- 2 files changed, 4 insertions(+), 17 deletions(-) diff --git a/components/bt/host/nimble/nimble b/components/bt/host/nimble/nimble index e934bb10bc0..f40b4612ece 160000 --- a/components/bt/host/nimble/nimble +++ b/components/bt/host/nimble/nimble @@ -1 +1 @@ -Subproject commit e934bb10bc041e44b7d4ed812819d8f2a9d87a03 +Subproject commit f40b4612ece8d38760acd44015c38c62c19a87c2 diff --git a/examples/bluetooth/nimble/ble_proximity_sensor/proximity_sensor_cent/main/main.c b/examples/bluetooth/nimble/ble_proximity_sensor/proximity_sensor_cent/main/main.c index e7029e278d4..1223715a026 100644 --- a/examples/bluetooth/nimble/ble_proximity_sensor/proximity_sensor_cent/main/main.c +++ b/examples/bluetooth/nimble/ble_proximity_sensor/proximity_sensor_cent/main/main.c @@ -24,14 +24,6 @@ static int8_t tx_pwr_lvl; static struct ble_prox_cent_conn_peer conn_peer[MYNEWT_VAL(BLE_MAX_CONNECTIONS) + 1]; static struct ble_prox_cent_link_lost_peer disconn_peer[MYNEWT_VAL(BLE_MAX_CONNECTIONS) + 1]; -/* Note: Path loss is calculated using formula : threshold - RSSI value - * by default threshold is kept -128 as per the spec - * high_threshold and low_threshold are hardcoded after testing and noting - * RSSI values when distance between devices are less and more. - */ -static int8_t high_threshold = -70; -static int8_t low_threshold = -100; - void ble_store_config_init(void); static void ble_prox_cent_scan(void); static int ble_prox_cent_gap_event(struct ble_gap_event *event, void *arg); @@ -661,16 +653,11 @@ ble_prox_cent_path_loss_task(void *pvParameters) MODLOG_DFLT(INFO, "path loss = %d pwr lvl = %d rssi = %d", path_loss, tx_pwr_lvl, rssi); - if ((conn_peer[i].val_handle != 0) && - (path_loss > high_threshold || path_loss < low_threshold)) { - - if (path_loss < low_threshold) { - path_loss = 0; - } - + if (conn_peer[i].val_handle != 0) { + int8_t path_loss_val = (int8_t)path_loss; #if MYNEWT_VAL(BLE_GATTC) rc = ble_gattc_write_no_rsp_flat(i, conn_peer[i].val_handle, - &path_loss, sizeof(path_loss)); + &path_loss_val, sizeof(path_loss_val)); if (rc != 0) { MODLOG_DFLT(ERROR, "Error: Failed to write characteristic; rc=%d\n", rc); From d2c2ca04ee34951936589d88266acd88b396c48d Mon Sep 17 00:00:00 2001 From: Sahil Yadav Date: Tue, 17 Mar 2026 12:47:18 +0530 Subject: [PATCH 5/6] feat(nimble): Add support to 6.2 BLE HCI Command Event (FSU, UTP over OTA) --- components/bt/host/nimble/nimble | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/components/bt/host/nimble/nimble b/components/bt/host/nimble/nimble index f40b4612ece..e52e061c494 160000 --- a/components/bt/host/nimble/nimble +++ b/components/bt/host/nimble/nimble @@ -1 +1 @@ -Subproject commit f40b4612ece8d38760acd44015c38c62c19a87c2 +Subproject commit e52e061c494d9a441e39233c40de4699a067da41 From 8f72ddab9231f37cb2a734dc54e0e40df8723a27 Mon Sep 17 00:00:00 2001 From: Rahul Tank Date: Fri, 17 Apr 2026 13:17:32 +0530 Subject: [PATCH 6/6] fix(nimble): Fixes for various CVEs *CVE-2025-62235 *CVE-2025-53477 *CVE-2025-53470 --- components/bt/host/nimble/nimble | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/components/bt/host/nimble/nimble b/components/bt/host/nimble/nimble index e52e061c494..df52b386a0c 160000 --- a/components/bt/host/nimble/nimble +++ b/components/bt/host/nimble/nimble @@ -1 +1 @@ -Subproject commit e52e061c494d9a441e39233c40de4699a067da41 +Subproject commit df52b386a0cc78997c2252ce034625212c35ca44