{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-19939 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2026-19939 yet. Limit exposure of the affected software until one is available.","what":"CVE-2026-19939 is a medium-severity use after free vulnerability in zephyrproject zephyr, published on 13 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-19939 and fix it if it is affected.\n\nWhat it is: CVE-2026-19939 is a medium-severity use after free vulnerability in zephyrproject zephyr, published on 13 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-19939 in the wild and no public exploit code.\n\nAffected product: zephyrproject zephyr. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-19939/ (Markdown: https://insights.sbomify.com/CVE-2026-19939/index.md)","id":"CVE-2026-19939","markdown":"https://insights.sbomify.com/CVE-2026-19939/index.md","name":"CVE-2026-19939","record":{"aliases":["GHSA-9mww-f3h4-mq95"],"analysis":{"component_type":"operating_system","fix_type":"patch","impacts":["code_execution","denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":true,"product_category":"Zephyr RTOS","requires_auth":"low_privilege","summary":"Remote attackers can corrupt kernel timeout lists via Bluetooth AVDTP disconnects, potentially causing crashes or code execution in Zephyr RTOS.","user_interaction":"not_required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"zephyr","cpe":[],"cvss":{"score":6.3,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","version":"3.1"},"cwes":[{"id":"CWE-825","name":"Expired Pointer Dereference"}],"description":"The AVDTP signalling layer arms a 6-second command timeout (AVDTP_TIMEOUT) in avdtp_send_cmd() whenever the local device issues an AVDTP request. Every response handler in subsys/bluetooth/host/classic/avdtp.c cancels session-\u003etimeout_work before clearing the pending request, but bt_avdtp_l2cap_disconnected() only cleared session-\u003ereq and left the delayable work armed. The struct bt_avdtp session is the first member of struct bt_a2dp, whose instances live in a static per-connection array, and a2dp_get_connection() in subsys/bluetooth/host/classic/a2dp.c wipes a slot with memset() as soon as session-\u003ebr_chan.chan.conn is NULL — which the L2CAP layer arranges immediately after the disconnect callback returns.\n\nA remote Bluetooth BR/EDR peer triggers the condition by opening the AVDTP signalling channel, letting the local application issue an AVDTP procedure (the standard A2DP flow issues bt_a2dp_discover() from the connected callback), then tearing the signalling channel down without responding and re-opening it within the remaining timeout window. The reconnect reaches a2dp_accept() → a2dp_get_connection(), which zeroes the whole struct bt_a2dp while the work item's struct _timeout is still linked into the kernel's global timeout list. Both the disconnect and the reconnect instants are chosen by the attacker, so no race has to be won; an encrypted BR/EDR link is required, and CONFIG_BT_A2DP (experimental) must be enabled.\n\nWith the default CONFIG_TIMEOUT_BACKEND_DLIST backend the kernel decides a timeout is inactive by testing whether its list node is linked, so after the memset() the kernel treats a node that is still on the global timeout list as free: the announce path pops a node whose links and handler pointer are NULL, and the next bt_work_reschedule() on the recycled session re-inserts the same node into a list that already contains it. The consequence is corruption of the single kernel data structure every timer, timeslice and sleep depends on — writes through zeroed or stale list pointers and a NULL handler dispatch — producing a system-wide crash or hang rather than a fault confined to the A2DP session.\n\nThe fix cancels session-\u003etimeout_work at the top of bt_avdtp_l2cap_disconnected() and moves k_work_init_delayable() from avdtp_send_cmd() to the session-establishment paths bt_avdtp_connect() and bt_avdtp_l2cap_accept(), so the work item is always initialized before a disconnect callback can run.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":false,"headline":"Bluetooth Classic AVDTP: stale timeout work on signalling-channel disconnect leads to kernel timeout-list corruption","id":"CVE-2026-19939","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"use_after_free","year":"2026"},"n_packages":0,"n_references":2,"next":{"headline":"Use after free in zephyr","id":"CVE-2026-19940"},"packages":[],"prev":{"headline":"Use-after-free of an ATT PDU buffer when signing an outgoing Bluetooth ATT Signed Write Command fails","id":"CVE-2026-19938"},"products":["zephyr"],"published":"2026-10-13","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-10-14","vendors":["zephyrproject"]},"summary":"Remote attackers can corrupt kernel timeout lists via Bluetooth AVDTP disconnects, potentially causing crashes or code execution in Zephyr RTOS.","url":"https://insights.sbomify.com/CVE-2026-19939/"}