AVDTP Signalling Vulnerability in Zephyr Project by Bluetooth

CVE-2026-19939

What is CVE-2026-19939?

This vulnerability arises in the AVDTP signalling layer of the Zephyr Project, where a 6-second command timeout may lead to system instability. An adversary can exploit this by manipulating the AVDTP procedure, effectively tearing down and re-establishing the signalling channel within the finite timeout. This manipulation results in the kernel mismanaging critical structures, potentially leading to a system-wide crash or hang. The misuse of the timeout features, particularly when assisted by certain configurations, allows for significant disruption. A patch has been implemented to ensure proper cancellation of pending commands upon disconnection, reinforcing the system's resilience against such exploitation.

References