Buffer Management Flaw in Bluetooth Host's ATT Transmit Path Affecting Zephyr OS by Nordic Semiconductor

CVE-2026-19938

What is CVE-2026-19938?

A buffer management flaw exists in the Bluetooth host's Attribute Protocol (ATT) transmit path within Zephyr OS, where a buffer is released incorrectly upon a signing operation failure. When a signed write command fails due to the absence of a local CSRK for the peer, the system incorrectly unreferences the buffer, leading to potential memory corruption. This mishandled buffer can be re-queued, causing dereferenced memory issues, and can result in erroneous PDU contents being transmitted, crashes, or assertion failures. Exposure to this vulnerability requires specific configuration settings and involves remote peer control, highlighting critical implications for application-level security in environments utilizing signed writes.

References