CVE-2026-19935: Bluetooth LE L2CAP Race Condition Vulnerability

CVE-2026-19935 Overview

CVE-2026-19935 is a use-after-free vulnerability [CWE-416] in the Zephyr RTOS Bluetooth LE host stack. The flaw affects L2CAP connection-oriented channels (CoC) that use dynamic Protocol Service Multiplexers (PSMs) in the range 0x0080-0x00FF. Channel teardown in l2cap_chan_destroy() fails to cancel the rx_work item queued on the system workqueue, allowing a queued work item to outlive the channel memory it references.

A remote, unauthenticated peer on an established CoC channel can trigger the condition by sending a data K-frame immediately followed by an L2CAP Disconnect Request.

Critical Impact
An adjacent attacker can corrupt the Zephyr system workqueue pending list, leading to memory corruption, dropped work items, or denial of service on affected Bluetooth-enabled devices.

Affected Products

Zephyr RTOS Bluetooth LE host stack (subsys/bluetooth/host/l2cap.c)
Configurations with CONFIG_BT_L2CAP_DYNAMIC_CHANNEL enabled
Devices using dynamic L2CAP PSMs in the 0x0080-0x00FF range

Discovery Timeline

2026-10-11 - CVE-2026-19935 published to NVD
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-19935

Vulnerability Analysis

The Bluetooth LE host queues received L2CAP CoC data for deferred processing through a struct k_work embedded in the channel object (le_chan->rx_work, handler l2cap_rx_process()). This occurs whenever the channel uses a dynamic PSM. The teardown function l2cap_chan_destroy() cancels the retransmission-timeout work and drains the RX FIFO, but never cancels rx_work.

Because the work item is submitted to the system workqueue while HCI receive processing runs on the dedicated Bluetooth RX workqueue (CONFIG_BT_RECV_WORKQ_BT, the default), a queued rx_work item can outlive the channel it references. The stack then invokes the released() callback, signalling the application may free the channel memory while the system workqueue still holds a pointer to it.

Root Cause

The root cause is a missing k_work_cancel() call for le_chan->rx_work in l2cap_chan_destroy(), combined with a workqueue mismatch. The system workqueue and the Bluetooth RX workqueue are cooperative threads at different priorities (K_PRIO_COOP(CONFIG_BT_RX_PRIO) versus CONFIG_SYSTEM_WORKQUEUE_PRIORITY), so the pending rx_work cannot preempt the Disconnect Request processing in le_disconn_req() -> l2cap_chan_del() -> l2cap_chan_destroy().

Attack Vector

A remote, unauthenticated peer with an established CoC channel sends a data K-frame followed immediately by an L2CAP Disconnect Request. If the application frees the channel memory after released(), the workqueue later dereferences a list node and handler function pointer in reused memory. If the object is re-accepted into a later connection, l2cap_chan_add() calls k_work_init() on a still-enqueued work item, corrupting the workqueue pending list. A variant race lets l2cap_rx_process() run concurrently with teardown, racing the net_buf unref of le_chan->_sdu and the clearing of chan->conn.

// Patch excerpt: route LE host work items to the Bluetooth workqueue
	if (ad_is_limited(ad, ad_len)) {
		k_work_init_delayable(&adv->lim_adv_timeout_work, adv_timeout);
-		k_work_reschedule(&adv->lim_adv_timeout_work,
-				  K_SECONDS(CONFIG_BT_LIM_ADV_TIMEOUT));
+		bt_work_reschedule(&adv->lim_adv_timeout_work,
+				   K_SECONDS(CONFIG_BT_LIM_ADV_TIMEOUT));
	}

	return err;
// Source: https://github.com/zephyrproject-rtos/zephyr/commit/22896cb8d6f23feffe4b637119fb3e974ac3bed8

Detection Methods for CVE-2026-19935

Indicators of Compromise

Unexpected device crashes or watchdog resets on Bluetooth-enabled Zephyr devices shortly after a BLE peer disconnect
System workqueue pending-list anomalies, such as unrelated work items being dropped or the queue appearing to spin on a looped list
Repeated L2CAP CoC connect/disconnect sequences from the same peer within short intervals targeting dynamic PSMs 0x0080-0x00FF

Detection Strategies

Instrument the Zephyr system workqueue to log work-item submission and completion addresses, flagging mismatches that indicate reused channel memory
Enable kernel sanity checks and CONFIG_ASSERT in builds to catch corrupted k_work state at k_work_init() time
Capture BLE HCI traces and look for K-frame data immediately preceding L2CAP Disconnect Request packets on dynamic PSMs

Monitoring Recommendations

Monitor firmware crash telemetry and reboot counts for fleets of BLE peripherals running Zephyr
Correlate BLE pairing and disconnect events against unexpected application restarts or memory-fault logs
Track inbound BLE connection patterns from unknown peers that establish and tear down CoC channels in rapid succession

How to Mitigate CVE-2026-19935

Immediate Actions Required

Apply the upstream Zephyr fix in commit 22896cb8d6f23feffe4b637119fb3e974ac3bed8 and rebuild affected firmware
Audit application-level CoC released() handlers to confirm channel memory is not freed before the workqueue drains
Review BLE pairing and bonding policies on exposed devices to restrict which peers can open dynamic PSM channels

Patch Information

The fix routes the channel RX work to the Bluetooth workqueue (the same context in which every teardown path runs) and adds an explicit k_work_cancel() of le_chan->rx_work in l2cap_chan_destroy(). After the patch, no reference to the channel survives the released() callback. See the Zephyr Security Advisory GHSA-6gp4-cwf7-2vp8 for complete details.

Workarounds

Disable CONFIG_BT_L2CAP_DYNAMIC_CHANNEL if the application does not require dynamic PSMs; configurations without it are not affected
Restrict the device to SIG-assigned PSMs such as EATT (0x0027) and OTS (0x0025), which take the inline receive path and are not affected
Limit BLE connectivity through pairing requirements and connection filtering to reduce exposure to unauthenticated peers

bash

# Kconfig example: disable dynamic L2CAP channels if not required
CONFIG_BT=y
CONFIG_BT_L2CAP_DYNAMIC_CHANNEL=n
# Keep the dedicated Bluetooth RX workqueue enabled (default)
CONFIG_BT_RECV_WORKQ_BT=y