CVE-2026-19939: Bluetooth AVDTP DOS Vulnerability

CVE-2026-19939 Overview

CVE-2026-19939 affects the Zephyr RTOS Bluetooth stack, specifically the Audio/Video Distribution Transport Protocol (AVDTP) signalling layer in subsys/bluetooth/host/classic/avdtp.c. The vulnerability stems from a delayable work item that remains armed in the kernel's global timeout list after the containing session structure is zeroed. A remote Bluetooth BR/EDR peer with an encrypted link can trigger kernel-wide memory corruption by disconnecting and reconnecting the AVDTP signalling channel within a 6-second window. The flaw is categorized as [CWE-825] (Expired Pointer Dereference) and requires CONFIG_BT_A2DP to be enabled.

Critical Impact
Successful exploitation corrupts the kernel's global timeout list, producing a system-wide crash or hang rather than a fault confined to the A2DP session.

Affected Products

Zephyr RTOS with CONFIG_BT_A2DP (experimental) enabled
Bluetooth Classic (BR/EDR) host stack components avdtp.c and a2dp.c
Builds using the default CONFIG_TIMEOUT_BACKEND_DLIST backend

Discovery Timeline

2026-10-13 - CVE CVE-2026-19939 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-19939

Vulnerability Analysis

The AVDTP signalling layer arms a 6-second command timeout (AVDTP_TIMEOUT) in avdtp_send_cmd() whenever the local device issues an AVDTP request. Every response handler cancels session->timeout_work before clearing the pending request. However, bt_avdtp_l2cap_disconnected() only cleared session->req and left the delayable work armed.

The struct bt_avdtp session is the first member of struct bt_a2dp, whose instances live in a static per-connection array. The function a2dp_get_connection() in subsys/bluetooth/host/classic/a2dp.c wipes a slot with memset() as soon as session->br_chan.chan.conn is NULL, which the L2CAP layer arranges immediately after the disconnect callback returns.

Root Cause

With the default CONFIG_TIMEOUT_BACKEND_DLIST backend, the kernel decides a timeout is inactive by testing whether its list node is linked. After the memset(), the kernel treats a node that is still on the global timeout list as free. The announce path pops a node whose links and handler pointer are NULL, and the next bt_work_reschedule() on the recycled session re-inserts the same node into a list that already contains it. The result is corruption of the single kernel data structure every timer, timeslice, and sleep depends on.

Attack Vector

A remote Bluetooth BR/EDR peer opens the AVDTP signalling channel and lets the local application issue an AVDTP procedure. The standard A2DP flow issues bt_a2dp_discover() from the connected callback. The attacker then tears the signalling channel down without responding and re-opens it within the remaining timeout window. The reconnect reaches a2dp_accept() → a2dp_get_connection(), which zeroes the whole struct bt_a2dp while the work item's struct _timeout is still linked into the kernel's global timeout list. Both the disconnect and reconnect instants are chosen by the attacker, so no race has to be won. An encrypted BR/EDR link is required.

// Patch excerpt from subsys/bluetooth/host/classic/avdtp.c
 
 	avdtp_send_common(session, buf);
 
-	/* Initialize and start timeout timer */
-	k_work_init_delayable(&session->timeout_work, avdtp_timeout);
 	/* Start timeout work */
 	bt_work_reschedule(&session->timeout_work, AVDTP_TIMEOUT);

Source: Zephyr Project patch commit a10d18c. The fix cancels session->timeout_work at the top of bt_avdtp_l2cap_disconnected() and moves k_work_init_delayable() from avdtp_send_cmd() to the session establishment paths bt_avdtp_connect() and bt_avdtp_l2cap_accept().

Detection Methods for CVE-2026-19939

Indicators of Compromise

Unexpected system-wide crashes, hangs, or watchdog resets on Zephyr devices with Bluetooth Classic enabled
Repeated L2CAP AVDTP signalling channel disconnect and reconnect events from the same BR/EDR peer within a 6-second window
Kernel panics referencing NULL handler dispatch or timeout list corruption shortly after Bluetooth pairing activity

Detection Strategies

Audit Bluetooth HCI logs for paired BR/EDR peers that repeatedly tear down and re-establish AVDTP (PSM 0x0019) channels without completing procedures
Correlate kernel fault telemetry with recent bt_a2dp_discover() activity and connection state transitions
Validate device firmware builds to detect whether CONFIG_BT_A2DP is enabled on fielded units

Monitoring Recommendations

Centralize device crash reports and Bluetooth link telemetry for anomaly detection across fleets of embedded devices
Monitor the physical and RF perimeter where Bluetooth-enabled Zephyr devices operate, since the attack requires adjacent-network proximity
Track upstream Zephyr Project security advisories for related classic Bluetooth vulnerabilities

How to Mitigate CVE-2026-19939

Immediate Actions Required

Apply the upstream Zephyr fix from commit a10d18c3be9d1a968574dbfbce6baee58ea398e8 and rebuild affected firmware
Disable CONFIG_BT_A2DP in production builds that do not require A2DP source or sink functionality
Restrict Bluetooth pairing to trusted devices and remove unused bonded peers from device databases

Patch Information

The Zephyr Project published the fix in commit a10d18c3be9d1a968574dbfbce6baee58ea398e8 and documented the issue in GitHub Security Advisory GHSA-9mww-f3h4-mq95. The patch cancels session->timeout_work at the top of bt_avdtp_l2cap_disconnected() and relocates k_work_init_delayable() to the session establishment paths so the work item is always initialized before a disconnect callback can run.

Workarounds

Disable Bluetooth Classic support entirely where only Bluetooth Low Energy is required
Limit AVDTP peers to known MAC addresses using application-layer allow lists where feasible
Reduce Bluetooth discoverable and connectable windows to shrink the attacker's opportunity to initiate AVDTP sessions

bash

# Example Kconfig change to disable A2DP in Zephyr builds
# prj.conf
CONFIG_BT_A2DP=n
CONFIG_BT_AVDTP=n