diff --git a/components/bt/common/btc/profile/esp/blufi/nimble_host/esp_blufi.c b/components/bt/common/btc/profile/esp/blufi/nimble_host/esp_blufi.c
index 0f26b9aa940..2cf920a54a5 100644
--- a/components/bt/common/btc/profile/esp/blufi/nimble_host/esp_blufi.c
+++ b/components/bt/common/btc/profile/esp/blufi/nimble_host/esp_blufi.c
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2026 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -331,7 +331,9 @@ esp_blufi_gap_event(struct ble_gap_event *event, void *arg)
         }
         if (event->connect.status != 0) {
             /* Connection failed; resume advertising. */
-           ((void(*)(void))arg)();
+           if (arg != NULL) {
+	       ((void(*)(void))arg)();
+	   }
         }
         return 0;
     case BLE_GAP_EVENT_DISCONNECT:
@@ -366,7 +368,9 @@ esp_blufi_gap_event(struct ble_gap_event *event, void *arg)
     case BLE_GAP_EVENT_ADV_COMPLETE:
         ESP_LOGI(TAG, "advertise complete; reason=%d",
                  event->adv_complete.reason);
-        ((void(*)(void))arg)();
+        if (arg != NULL) {
+            ((void(*)(void))arg)();
+        }
         return 0;
 
     case BLE_GAP_EVENT_SUBSCRIBE:
diff --git a/components/bt/host/nimble/Kconfig.in b/components/bt/host/nimble/Kconfig.in
index 5c7856d2d9a..16d978d8f34 100644
--- a/components/bt/host/nimble/Kconfig.in
+++ b/components/bt/host/nimble/Kconfig.in
@@ -160,10 +160,11 @@ menu "Security (SMP)"
             default 0
             help
                 LE Security Mode 1 Levels:
-                1. No Security
-                2. Unauthenticated pairing with encryption
-                3. Authenticated pairing with encryption
-                4. Authenticated LE Secure Connections pairing with encryption using a 128-bit strength encryption key.
+                1(0). No Security
+                2(1). Unauthenticated pairing with encryption
+                3(2). Authenticated pairing with encryption
+                4(3). Authenticated LE Secure Connections pairing with encryption using a
+                128-bit strength encryption key.
 
         config BT_NIMBLE_SM_SC_ONLY
             int "Enable Secure Connections Only Mode"
@@ -296,7 +297,7 @@ menu "GAP"
 
     config BT_NIMBLE_CRYPTO_STACK_MBEDTLS
         bool "Override TinyCrypt with mbedTLS for crypto computations"
-        default y
+        default n if CONFIG_BT_SMP_CRYPTO_STACK_TINYCRYPT
         depends on BT_NIMBLE_ENABLED
         select MBEDTLS_CMAC_C
         help
@@ -820,7 +821,7 @@ menu "BLE 6.x Features"
 
     if BT_NIMBLE_60_FEATURE_SUPPORT
         config BT_NIMBLE_CHANNEL_SOUNDING
-            bool "ble channel souding feature"
+            bool "ble channel sounding feature"
             default n
             help
                 Used to enable/disable the channel sounding feature
diff --git a/components/bt/host/nimble/esp-hci/src/esp_nimble_hci.c b/components/bt/host/nimble/esp-hci/src/esp_nimble_hci.c
index 82d8ad82b68..326f3d946e9 100644
--- a/components/bt/host/nimble/esp-hci/src/esp_nimble_hci.c
+++ b/components/bt/host/nimble/esp-hci/src/esp_nimble_hci.c
@@ -191,7 +191,7 @@ static void ble_hci_rx_acl(uint8_t *data, uint16_t len)
         m = ble_transport_alloc_acl_from_ll();
 
         if (!m) {
-            if (retry_count % 5) {
+            if (retry_count % 5 == 0) {
                 esp_rom_printf("ACL buf alloc failed %d times\n", retry_count);
                 esp_rom_printf("Free ACL mbufs: %d\n", os_msys_num_free());
             }
diff --git a/components/bt/host/nimble/nimble b/components/bt/host/nimble/nimble
index 420a6e672e7..6128c09f0b9 160000
--- a/components/bt/host/nimble/nimble
+++ b/components/bt/host/nimble/nimble
@@ -1 +1 @@
-Subproject commit 420a6e672e7b6b638171b779ad0d26da8b09712b
+Subproject commit 6128c09f0b90af95fedc94beb2f6bdadc330714c
diff --git a/components/bt/host/nimble/port/include/ble_svc_gap_stub.h b/components/bt/host/nimble/port/include/ble_svc_gap_stub.h
index 1fb456f2194..1d5f48284c9 100644
--- a/components/bt/host/nimble/port/include/ble_svc_gap_stub.h
+++ b/components/bt/host/nimble/port/include/ble_svc_gap_stub.h
@@ -39,12 +39,15 @@ static inline const char *ble_svc_gap_device_name(void)
 
 static inline int ble_svc_gap_device_appearance_set(uint16_t appearance)
 {
+    (void)appearance;
     ESP_LOGE(BLE_SVC_GAP_TAG, "GAP service not enabled. Enable CONFIG_BT_NIMBLE_GAP_SERVICE to use this API.");
     return -1;
 }
 
 static inline int ble_svc_gap_device_key_material_set(uint8_t *session_key, uint8_t *iv)
 {
+    (void)session_key;
+    (void)iv;
     ESP_LOGE(BLE_SVC_GAP_TAG, "GAP service not enabled. Enable CONFIG_BT_NIMBLE_GAP_SERVICE to use this API.");
     return -1;
 }
diff --git a/components/bt/host/nimble/port/include/esp_nimble_cfg.h b/components/bt/host/nimble/port/include/esp_nimble_cfg.h
index eea72da7b52..494c358a221 100644
--- a/components/bt/host/nimble/port/include/esp_nimble_cfg.h
+++ b/components/bt/host/nimble/port/include/esp_nimble_cfg.h
@@ -2313,7 +2313,7 @@
 #ifdef CONFIG_BT_NIMBLE_EXTRA_ADV_FIELDS
 #define MYNEWT_VAL_BLE_EXTRA_ADV_FIELDS CONFIG_BT_NIMBLE_EXTRA_ADV_FIELDS
 #else
-#define CONFIG_BT_NIMBLE_EXTRA_ADV_FIELDS  (0)
+#define MYNEWT_VAL_BLE_EXTRA_ADV_FIELDS  (0)
 #endif
 #endif
 
@@ -2358,7 +2358,7 @@
 #ifdef CONFIG_BT_NIMBLE_STATIC_PASSKEY
 #define MYNEWT_VAL_STATIC_PASSKEY  CONFIG_BT_NIMBLE_STATIC_PASSKEY
 #else
-#define CONFIG_BT_NIMBLE_STATIC_PASSKEY (0)
+#define MYNEWT_VAL_STATIC_PASSKEY (0)
 #endif
 #endif
 
diff --git a/components/protocomm/src/simple_ble/simple_ble.c b/components/protocomm/src/simple_ble/simple_ble.c
index 370cc91d440..27749764197 100644
--- a/components/protocomm/src/simple_ble/simple_ble.c
+++ b/components/protocomm/src/simple_ble/simple_ble.c
@@ -33,6 +33,9 @@ static esp_bd_addr_t s_cached_remote_bda = {0x0,};
 
 uint8_t get_keep_ble_on()
 {
+    if (g_ble_cfg_p == NULL) {
+        return 0;
+    }
     return g_ble_cfg_p->keep_ble_on;
 }
 
diff --git a/examples/bluetooth/nimble/ble_ancs/main/ble_ancs.c b/examples/bluetooth/nimble/ble_ancs/main/ble_ancs.c
index 1ec0346aa6b..0180ea86c16 100644
--- a/examples/bluetooth/nimble/ble_ancs/main/ble_ancs.c
+++ b/examples/bluetooth/nimble/ble_ancs/main/ble_ancs.c
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2021-2025 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2021-2026 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Unlicense OR CC0-1.0
  */
@@ -132,13 +132,13 @@ void ble_receive_apple_data_source(uint8_t *message, uint16_t message_len)
                 return;
             }
             uint32_t NotificationUID = (message[1]) | (message[2]<< 8) | (message[3]<< 16) | (message[4] << 24);
-            uint32_t remian_attr_len = message_len - 5;
+            uint32_t remain_attr_len = message_len - 5;
             uint8_t *attrs = &message[5];
             ESP_LOGI(NimBLE_ANCS_TAG, "recevice Notification Attributes response Command_id %d NotificationUID %" PRIu32, Command_id, NotificationUID);
-            while(remian_attr_len >= 3) {
+            while(remain_attr_len > 0) {
                 uint8_t AttributeID = attrs[0];
                 uint16_t len = attrs[1] | (attrs[2] << 8);
-                if(len > remian_attr_len - 3) {
+                if(len > (remain_attr_len -3)) {
                     ESP_LOGE(NimBLE_ANCS_TAG, "data error");
                     break;
                 }
@@ -175,16 +175,16 @@ void ble_receive_apple_data_source(uint8_t *message, uint16_t message_len)
                 }
 
                 attrs += (1 + 2 + len);
-                remian_attr_len -= (1 + 2 + len);
+                remain_attr_len -= (1 + 2 + len);
             }
 
             break;
         }
         case CommandIDGetAppAttributes:
-            ESP_LOGI(NimBLE_ANCS_TAG, "recevice APP Attributes response");
+            ESP_LOGI(NimBLE_ANCS_TAG, "received APP Attributes response");
             break;
         case CommandIDPerformNotificationAction:
-            ESP_LOGI(NimBLE_ANCS_TAG, "recevice Perform Notification Action");
+            ESP_LOGI(NimBLE_ANCS_TAG, "received Perform Notification Action");
             break;
         default:
             ESP_LOGI(NimBLE_ANCS_TAG, "unknown Command ID");
@@ -213,5 +213,4 @@ char *Errcode_to_String(uint16_t status)
             break;
     }
     return Errstr;
-
 }
diff --git a/examples/bluetooth/nimble/ble_chan_sound_initiator/main/ble_chan_initiator.h b/examples/bluetooth/nimble/ble_chan_sound_initiator/main/ble_chan_initiator.h
index 4997060d65c..23bf2512860 100644
--- a/examples/bluetooth/nimble/ble_chan_sound_initiator/main/ble_chan_initiator.h
+++ b/examples/bluetooth/nimble/ble_chan_sound_initiator/main/ble_chan_initiator.h
@@ -24,7 +24,6 @@ union ble_store_key;
 #define BLE_HCI_LE_CS_SUBEVENT_DONE_STATUS_ABORTED   0xF
 
 #define LOCAL_PROCEDURE_MEM  1024  // Replace with an appropriate constant value
-struct ble_hs_cfg;
 struct ble_gatt_register_ctxt;
 
 /** GATT server. */
diff --git a/examples/bluetooth/nimble/ble_cts/cts_cent/main/main.c b/examples/bluetooth/nimble/ble_cts/cts_cent/main/main.c
index 2d3bb9d6598..d8c5840ec8d 100644
--- a/examples/bluetooth/nimble/ble_cts/cts_cent/main/main.c
+++ b/examples/bluetooth/nimble/ble_cts/cts_cent/main/main.c
@@ -520,7 +520,7 @@ ble_cts_cent_gap_event(struct ble_gap_event *event, void *arg)
                       (event->cache_assoc.cache_state == 0) ? "INVALID" : "LOADED");
           /* Perform service discovery */
           rc = peer_disc_all(event->cache_assoc.conn_handle,
-                             blecent_on_disc_complete, NULL);
+                             ble_cts_cent_on_disc_complete, NULL);
           if(rc != 0) {
                 MODLOG_DFLT(ERROR, "Failed to discover services; rc=%d\n", rc);
                 return 0;
diff --git a/examples/bluetooth/nimble/ble_gattc_gatts_coex/main/main.c b/examples/bluetooth/nimble/ble_gattc_gatts_coex/main/main.c
index d9d16a91e0c..e33df0579fb 100644
--- a/examples/bluetooth/nimble/ble_gattc_gatts_coex/main/main.c
+++ b/examples/bluetooth/nimble/ble_gattc_gatts_coex/main/main.c
@@ -348,7 +348,7 @@ blecoex_gap_event(struct ble_gap_event *event, void *arg)
 
     case BLE_GAP_EVENT_CONNECT:
 	MODLOG_DFLT(INFO, "%s connection %s; status=%d ",
-	            client_connect == 1 ? "Client" : "Server",
+		    client_connect == 1 ? "Client" : "Server",
                     event->connect.status == 0 ? "established" : "failed",
                     event->connect.status);
 
diff --git a/examples/bluetooth/nimble/ble_htp/htp_cent/main/main.c b/examples/bluetooth/nimble/ble_htp/htp_cent/main/main.c
index 447631ae3e6..2ee915c563e 100644
--- a/examples/bluetooth/nimble/ble_htp/htp_cent/main/main.c
+++ b/examples/bluetooth/nimble/ble_htp/htp_cent/main/main.c
@@ -628,8 +628,8 @@ ble_htp_cent_gap_event(struct ble_gap_event *event, void *arg)
                       event->cache_assoc.status,
                       (event->cache_assoc.cache_state == 0) ? "INVALID" : "LOADED");
           /* Perform service discovery */
-          rc = peer_disc_all(event->cache_assoc.conn_handle,
-                             blecent_on_disc_complete, NULL);
+          rc = peer_disc_all(event->connect.conn_handle,
+                             ble_htp_cent_on_disc_complete, NULL);
           if(rc != 0) {
                 MODLOG_DFLT(ERROR, "Failed to discover services; rc=%d\n", rc);
                 return 0;
diff --git a/examples/bluetooth/nimble/ble_proximity_sensor/proximity_sensor_cent/main/main.c b/examples/bluetooth/nimble/ble_proximity_sensor/proximity_sensor_cent/main/main.c
index db7c007b336..52369ad198e 100644
--- a/examples/bluetooth/nimble/ble_proximity_sensor/proximity_sensor_cent/main/main.c
+++ b/examples/bluetooth/nimble/ble_proximity_sensor/proximity_sensor_cent/main/main.c
@@ -581,8 +581,8 @@ ble_prox_cent_gap_event(struct ble_gap_event *event, void *arg)
                       event->cache_assoc.status,
                       (event->cache_assoc.cache_state == 0) ? "INVALID" : "LOADED");
           /* Perform service discovery */
-          rc = peer_disc_all(event->cache_assoc.conn_handle,
-                             blecent_on_disc_complete, NULL);
+          rc = peer_disc_all(event->connect.conn_handle,
+                             ble_prox_cent_on_disc_complete, NULL);
           if(rc != 0) {
                 MODLOG_DFLT(ERROR, "Failed to discover services; rc=%d\n", rc);
                 return 0;
diff --git a/examples/bluetooth/nimble/blecent/README.md b/examples/bluetooth/nimble/blecent/README.md
index 04b39ae6305..a2103fc242f 100644
--- a/examples/bluetooth/nimble/blecent/README.md
+++ b/examples/bluetooth/nimble/blecent/README.md
@@ -165,7 +165,7 @@ The following configuration flags can be adjusted to significantly reduce RAM us
 | CONFIG_COMPILER_OPTIMIZATION_SIZE               | n → y           | 8408              |
 | CONFIG_COMPILER_OPTIMIZATION_ASSERTIONS_DISABLE | n → y           | 5896              |
 | CONFIG_ESP_COEX_SW_COEXIST_ENABLE               | y → n           | 896               |
-| ESP_TASK_WDT_EN                                 | y → n           | 528               |
+| CONFIG_ESP_TASK_WDT_EN                          | y → n           | 528               |
 | CONFIG_LOG_DEFAULT_LEVEL_NONE                   | n → y           | 2592              |
 
 ## Troubleshooting
diff --git a/examples/bluetooth/nimble/bleprph/README.md b/examples/bluetooth/nimble/bleprph/README.md
index b53fec70fdd..7561e45bf24 100644
--- a/examples/bluetooth/nimble/bleprph/README.md
+++ b/examples/bluetooth/nimble/bleprph/README.md
@@ -103,7 +103,7 @@ Notification sent successfully
 The following configuration flags can be adjusted to significantly reduce RAM usage in your ESP-IDF project while retaining basic BLE functionality.
 
 | Config Option                                    | Old → New Value | RAM Saved (Bytes)  |
-|--------------------------------------------------|-----------------|--------------------|
+| -------------------------------------------------|---------------- | ------------------ |
 | CONFIG_BT_NIMBLE_SM_SC                           | y → n           | 2016               |
 | CONFIG_BT_NIMBLE_LL_CFG_FEAT_LE_ENCRYPTION       | y → n           | 32                 |
 | CONFIG_BT_NIMBLE_GATT_MAX_PROCS                  | 4 → 2           | 112                |
diff --git a/examples/bluetooth/nimble/common/nimble_central_utils/peer.c b/examples/bluetooth/nimble/common/nimble_central_utils/peer.c
index 1ccb7283e22..1034cff33b8 100644
--- a/examples/bluetooth/nimble/common/nimble_central_utils/peer.c
+++ b/examples/bluetooth/nimble/common/nimble_central_utils/peer.c
@@ -515,7 +515,7 @@ peer_inc_add(struct peer *peer,  uint16_t svc_start_handle,
         }
     }
 
-    /* Including the services into inlucding list */
+    /* Including the services into including list */
 
     cur_svc = peer_svc_find_range(peer, gatt_incl_svc->handle);