Bluetooth LE Host Vulnerability in Zephyr Project Software by Zephyr Project

CVE-2026-19935

What is CVE-2026-19935?

The Bluetooth LE host in Zephyr Project software has a vulnerability that allows a remote, unauthenticated peer to exploit the L2CAP connection-oriented channel (CoC). When a data K-frame is sent followed by an L2CAP Disconnect Request, it leads to a scenario where pending work items can outlive their associated channels. This can result in memory corruption, as the system workqueue holds references to released memory, potentially allowing exploitation through dereferencing invalid pointers. The proposed fix ensures that work associated with the channel is managed directionally with channel teardown processes to prevent any residue references from existing after the release callback.

References