CVE-2026-19939

Name of the Vulnerable Software and Affected Versions Zephyr (affected versions not specified)

Description An issue exists in the AVDTP signalling layer where the bt avdtp l2cap disconnected() function fails to cancel the session->timeout work delayable work item when a connection is lost. A remote Bluetooth BR/EDR peer can exploit this by opening an AVDTP signalling channel, triggering an AVDTP procedure, and then disconnecting and reconnecting within the 6-second timeout window. This sequence causes the a2dp get connection() function to clear the bt a2dp structure using memset() while the timeout work item remains linked to the kernel's global timeout list. Consequently, the kernel may treat the node as free, leading to the corruption of the kernel data structure used for timers, timeslices, and sleep operations. This results in a system-wide crash or hang. This condition requires an encrypted BR/EDR link and the CONFIG BT A2DP experimental option to be enabled.

Recommendations Cancel session->timeout work within the bt avdtp l2cap disconnected() function. Move the k work init delayable() call from avdtp send cmd() to the session-establishment paths bt avdtp connect() and bt avdtp l2cap accept() to ensure the work item is initialized before a disconnect callback occurs.