Zephyr RTOS
CVE-2026-19938
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessWithin Bluetooth range of victim
-
DeliveryNegotiate pairing without distributing/accepting CSRK
-
ExploitVictim app issues signed ATT write, bt_smp_sign() returns -ENOENT
-
ExecutionBuffer wrongly unref'd then re-queued and reused
-
PersistNet_buf list corruption / double-free / OOB signature write
-
ImpactDevice crash or memory corruption
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires all of: (1) the deprecated CONFIG_BT_SIGNING build option enabled (non-default); (2) an application that calls bt_gatt_write_without_response_cb() with the sign flag set on an unencrypted connection; (3) no local CSRK existing for the peer so bt_smp_sign() returns -ENOENT - a state the remote peer controls by pairing without requesting the signing key, pairing with No Bonding, remaining unpaired, or keeping the link unencrypted; and (4) the attacker being within Bluetooth radio range (adjacent, AV:A). Limiting factors that reduce real-world risk: the vulnerable configuration is deprecated and off by default, the victim application must actively issue signed writes, and physical radio proximity is required; there is no confidentiality impact and the out-of-bounds write is bounded to 12 octets and only reachable in builds where the net_buf tailroom assertion is compiled out. |
| Impact | This is a genuine but conditional memory-safety defect (CWE-416 use-after-free plus a bounded heap out-of-bounds write) in the Zephyr Bluetooth host ATT transmit path, confirmed by a vendor commit (ba8627d) and GHSA-p3r4-qw98-j59m. The provided CVSS 3.1 vector (AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H, 5.9 Medium) is internally consistent with the description: AV:A reflects Bluetooth radio adjacency, AC:H reflects the multiple negotiation/timing preconditions, and A:H reflects the typical crash/assertion outcome. No EPSS score was supplied, there is no CISA KEV listing, and no public exploit is referenced - so no public exploit identified at time of analysis, and there is no evidence of active or widespread exploitation. The dominant real-world limiter is NOT the CVSS metrics but the configuration gate: exploitation requires the deprecated CONFIG_BT_SIGNING option to be enabled AND an application that actually issues signed writes. Note a nuance to verify with defenders: although CVSS encodes PR:N (the remote peer needs no authentication and in fact controls the triggering condition by refusing/omitting CSRK distribution), the bug only manifests in a non-default, deprecated build configuration, so the practical attack surface is far narrower than PR:N alone suggests. Net: treat as a patch-soon reliability/DoS and memory-corruption issue for products shipping signed-write ATT in a BT_SIGNING build, not an emergency for the typical default-configured deployment. |
| Exploit ScenarioDerived | An attacker within Bluetooth range of a Zephyr device that has CONFIG_BT_SIGNING enabled and runs an app issuing signed ATT writes pairs (or declines to pair) in a way that leaves no local CSRK for the peer, then lets the victim's next signed write take the failing bt_smp_sign() path. The resulting use-after-free/double-free corrupts the net_buf ATT TX/free lists (and on retry appends a second 12-octet signature past the buffer end), producing wrong-PDU transmission, a double free at disconnect, or a crash/assertion. No public exploit code is referenced for this CVE. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
Memory corruption in the Zephyr RTOS Bluetooth host ATT transmit path can be triggered by a peer in Bluetooth radio range whenever an application issues an ATT Signed Write Command over an unencrypted link. In chan_send(), the BT_ATT_OP_SIGNED_WRITE_CMD branch unrefers a net_buf it does not own after bt_smp_sign() fails (no local CSRK exists for the peer - a state the remote peer controls by pairing without requesting the signing key, pairing with No Bonding, staying unpaired, or keeping the link unencrypted); the callers honor the opposite ownership contract, so the already-freed buffer is re-queued, dereferenced and freed a second time, corrupting the ATT TX FIFO, deferred-destroy and pool free lists, while a related retry path can append a second 12-octet signature into a pooled buffer sized for one. Exploitation requires the deprecated, non-default CONFIG_BT_SIGNING build option plus a victim application that actually performs signed writes, giving CVSS 5.9 (AV:A/AC:H/PR:N, no confidentiality impact, high availability impact, low integrity impact); a vendor fix commit and GHSA-p3r4-qw98-j59m are available, and no public exploit was identified at time of analysis.
RemediationAI
Patch available per vendor advisory: integrate upstream fix commit ba8627d91c8ce15c26224cbc7f7f92bb66f56b03 into subsys/bluetooth/host/att.c (or adopt a Zephyr revision that contains it) - the commit stops the signed-write branch from unrefing the caller's buffer on bt_smp_sign() failure and moves the net_buf_simple_state save before signing so retries cannot append a second signature; a released version number carrying this fix is not independently confirmed, so verify against the GHSA-p3r4-qw98-j59m advisory. The most direct compensating control is to disable CONFIG_BT_SIGNING entirely: it is deprecated and off by default, and disabling it compiles out the vulnerable BT_ATT_OP_SIGNED_WRITE_CMD handling path, at the cost of losing ATT signed-write support for applications that rely on it (such applications must instead use encryption/bonding to protect writes). If signing must remain enabled, avoid issuing signed writes on unencrypted connections - set the sign flag only on links where the peer has been bonded and has distributed the signing key so a local CSRK exists and bt_smp_sign() cannot fail with -ENOENT - restrict the peer set, and treat peers that pair with No Bonding or omit CSRK distribution as untrusted; these measures reduce but do not eliminate exposure because CSRK availability is negotiated by the remote peer. Because the attack surface is adjacent (Bluetooth radio range), physical/RF proximity control and disabling Bluetooth where unused also reduce risk. No vendor workaround eliminates both the use-after-free and the bounded out-of-bounds write; patching is the only complete fix.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a use-after-free (CWE-416) arising from a violated buffer-ownership contract inside Zephyr's Bluetooth host ATT implementation in subsys/bluetooth/host/att.c, affecting the Zephyr project code base (CPE cpe:2.3:a:zephyrproject:zephyr). chan_send() documents that on failure the caller retains ownership of the net_buf; every other error exit follows that rule, but the signed-write branch called net_buf_unref(buf) when bt_smp_sign() returned an error and then propagated the error. Callers act on the documented contract: process_queue() re-queues the buffer via k_queue_prepend(), bt_att_chan_send_rsp() returns it to chan->tx_queue, bt_att_chan_req_send() restores it into the pending request, and att_req_retry() unrefers it again - producing re-queue of freed memory and a double free. struct net_buf's node field doubles as the linkage word for the ATT TX FIFO, the deferred-destroy list used by the att_pool destroy callback att_tx_destroy(), and the pool free list, so the mishandled buffer can corrupt those lists and be re-issued by bt_att_create_pdu() to a new PDU while the ATT TX path still holds a reference (wrong PDU contents or a double free when queues are drained at disconnect). The trigger is reachable whenever an application calls bt_gatt_write_without_response_cb() with sign set on an unencrypted connection and bt_smp_sign() fails with -ENOENT because no local CSRK was stored; smp_distribute_keys() only stores a local CSRK when the peer's pairing key-distribution field requests the signing key and bonding was agreed, which the peer fully controls. A second defect in the same branch saved net_buf_simple_state only after signing, so a buffer restored following a bt_l2cap_send_pdu() failure kept its 12-octet signature; a retry re-signed it and appended a second signature with net_buf_add(buf, 12) to a buffer bt_att_create_pdu() sized for exactly one signature, giving a bounded heap out-of-bounds write in builds where the net_buf tailroom assertion is compiled out. The upstream fix (commit ba8627d91c8ce15c26224cbc7f7f92bb66f56b03) restores the pre-signing buffer state on failure and keeps the save/restore ordering correct so retries re-sign from an unsigned buffer rather than appending a second signature.
Know when Bluetooth gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
AV:A for Bluetooth proximity; AC:H for the multiple negotiation/config preconditions; PR:N/UI:N since the remote peer triggers it without auth; I:L for wrong-PDU transmission and A:H for the crash/corruption, no confidentiality impact.
Primary rating from Vendor (zephyr).
CVSS VectorVendor: zephyr
DescriptionCVE.org
The Bluetooth host's ATT transmit path releases a buffer it does not own when signing fails. chan_send() in subsys/bluetooth/host/att.c documents (and every other error exit implements) the contract that on failure the caller retains ownership of the net_buf; the BT_ATT_OP_SIGNED_WRITE_CMD branch instead called net_buf_unref(buf) when bt_smp_sign() returned an error and then returned that error to the caller. The callers act on the contract: process_queue() re-queues the buffer with k_queue_prepend(), bt_att_chan_send_rsp() puts it back on chan->tx_queue, bt_att_chan_req_send() restores it into the request, and att_req_retry() unreferences it - so the already-freed buffer was re-queued, later dereferenced, and eventually freed again.
An ATT Signed Write Command is produced when an application calls bt_gatt_write_without_response_cb() with sign set on an unencrypted connection. bt_smp_sign() fails whenever no local CSRK exists for the peer (-ENOENT), and whether one exists is negotiated with the peer: smp_distribute_keys() stores a local CSRK only when the peer's pairing key-distribution field requests the signing key and bonding was agreed. A peer can therefore pair without accepting the CSRK, pair with No Bonding, remain unpaired, or keep the link unencrypted, and the victim's next signed write takes the failing path. Because struct net_buf's node field is simultaneously the linkage word for the ATT TX FIFO, for the deferred-destroy list used by the att_pool destroy callback att_tx_destroy(), and for the pool free list, the mishandled buffer corrupts these lists and can be re-issued by bt_att_create_pdu() to a new PDU while the ATT TX path still holds it.
The same branch also saved the net_buf_simple_state only after signing, so a buffer restored after a bt_l2cap_send_pdu() failure kept its 12-octet signature; a subsequent retry re-signed it and appended a second signature with net_buf_add(buf, 12) to a buffer that bt_att_create_pdu() sized for exactly one, writing past the end of the pooled buffer in builds where the net_buf tailroom assertion is compiled out.
Impact is host-side memory corruption in the Bluetooth stack: list corruption, a pooled ATT buffer with two owners (wrong PDU contents transmitted, or a double free when the queues are drained at disconnect), and a bounded out-of-bounds write on the retry path - typically observed as a crash or assertion failure. Exposure requires the deprecated CONFIG_BT_SIGNING to be enabled and an application that actually issues signed writes; in that configuration the triggering condition is under the remote peer's control.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Affected Products (CPE)CVE.org
Unauthenticated Bluetooth Low Energy OTA firmware upgrade in the Meatmeet Pro WiFi & Bluetooth Meat Thermometer firmware
CVE-2025-32879 is a security vulnerability (CVSS 8.8) that allows an attacker. Risk factors: public PoC available.
Zephyr's Bluetooth Low Energy connection-response handler fails to verify that a connection request was actually initiat
Heap OOB write in Android Bluetooth driver via incorrect bounds check.
A use-after-free in the Android Bluetooth stack (bluetooth_ccc.cc, function BluetoothCccHandlerCallbackImpl) lets an att
Legacy pairing and secure-connections pairing authentication in Bluetooth BR/EDR Core Specification v5.2 and earlier may
Memory corruption in the Zephyr RTOS LE Audio Broadcast Sink (subsys/bluetooth/audio/bap_broadcast_sink.c) lets an attac
A memory leak combined with a use-after-free in the Linux kernel's Bluetooth HCI connection-setup path can crash the ker
A race condition in the Linux kernel's Bluetooth L2CAP subsystem allows a use-after-free of the hci_conn::l2cap_data poi
Bluetooth authentication bypass in SwitchBot Door Lock Series allows an attacker within BLE range to manipulate the lock
Out-of-bounds read in the Linux kernel Bluetooth subsystem's eir_get_service_data() leaks kernel heap memory into usersp
Use-after-free in the Linux kernel Bluetooth L2CAP stack lets a Bluetooth-adjacent attacker corrupt kernel memory by rac
Exploit-DB