CVE-2026-19939 zephyrproject CVE debrief

Who should care

Defenders responsible for Bluetooth configurations and system security should assess exposure and prioritize patching to prevent potential system crashes or hangs. This includes reviewing and updating Bluetooth configurations to ensure secure connections, monitoring system logs for potential exploitation attempts, and verifying patch application to prevent potential system crashes or hangs. Additionally, defenders should consider the potential operational

Why it matters

Defenders should prioritize verifying and applying the patch to prevent potential system crashes or hangs caused by exploitation of the AVDTP signalling layer vulnerability.

• System crashes or hangs due to exploitation
• Potential disruption of critical system services
• Increased risk of denial-of-service attacks
• Need for verification of patch application

Technical summary

The AVDTP signalling layer arms a 6-second command timeout (AVDTP_TIMEOUT) in avdtp_send_cmd() whenever the local device issues an AVDTP request. A remote Bluetooth BR/EDR peer triggers the condition by opening the AVDTP signalling channel, letting the local application issue an AVDTP procedure, then tearing the signalling channel down without responding and re-opening it within the remaining timeout window.

Defensive priority

Defenders should prioritize verifying and applying the patch to prevent potential system crashes or hangs.

Recommended defensive actions

• Verify and apply the patch to prevent potential system crashes or hangs
• Review and update Bluetooth configurations to ensure secure connections
• Monitor system logs for potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is caused by a flaw in the AVDTP signalling layer, which allows a remote peer to trigger a system-wide crash or hang. The fix cancels session->timeout_work at the top of bt_avdtp_l2cap_disconnected() and moves k_work_init_delayable() from avdtp_send_cmd() to the session-establishment paths.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.