CVE-2026-19935

Name of the Vulnerable Software and Affected Versions ZephyrProject Zephyr (affected versions not specified)

Description An issue exists in the Bluetooth LE host where received L2CAP connection-oriented channel (CoC) data is queued for deferred processing using a k work structure embedded in the channel object (le chan->rx work with handler l2cap rx process()) when dynamic PSMs (0x0080-0x00FF) are used. During channel teardown in the l2cap chan destroy() function within subsys/bluetooth/host/l2cap.c, the system fails to cancel the rx work item.

A remote, unauthenticated peer can exploit this by sending a data K-frame followed immediately by an L2CAP Disconnect Request. Due to differences in workqueue priorities, the rx work item may remain pending while the channel is destroyed and its memory is freed or reused. This can lead to the system workqueue dereferencing reused memory or corrupting the workqueue's pending list if l2cap chan add() is called on a reused object. Additionally, a race condition may occur between l2cap rx process() and the teardown process regarding the net buf unreference of le chan-> sdu and the clearing of chan->conn.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.