Zephyr A2DP EUVD-2026-98924

Requires that the victim be built with the experimental CONFIG_BT_A2DP option enabled and acting as a classic Bluetooth BR/EDR A2DP endpoint, and that the local application issue an AVDTP procedure (the standard A2DP flow calls bt_a2dp_discover() from the connected callback, arming the 6-second AVDTP_TIMEOUT). The attacker must hold an encrypted - thus paired/bonded - BR/EDR link, then disconnect the AVDTP signalling channel without responding and re-open it within the remaining timeout window; the default CONFIG_TIMEOUT_BACKEND_DLIST timeout backend is required for the free-node mis-detection. Limiting factors: non-default experimental feature, mandatory paired/encrypted BR/EDR link (PR:L), adjacency (Bluetooth radio range, AV:A), and classic BR/EDR rather than BLE. No user interaction is needed, and because the attacker controls both the disconnect and reconnect timing, no race must be won.

This is a moderate-priority denial-of-service issue whose real-world risk is tightly bounded by its preconditions, not a widespread emergency. The CVSS 6.3 vector (AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) correctly captures an adjacent-network (Bluetooth BR/EDR) attack requiring an encrypted - therefore paired/authenticated - link, which is why PR:L rather than PR:N is appropriate. Attack complexity is genuinely low: the description is explicit that the attacker chooses both the disconnect and reconnect instants, so 'no race has to be won,' making exploitation deterministic once preconditions are met. No EPSS score, KEV listing, or public POC was provided in the input, so there is no signal of active or probable exploitation - no public exploit identified at time of analysis. The impact is real and severe in kind (corruption of the kernel's single global timeout list via a use-after-free/expired-pointer dereference, CWE-825, yielding a system-wide crash or hang rather than a contained A2DP fault), but it is reachable only when the experimental CONFIG_BT_A2DP option is enabled and the device is a classic-Bluetooth A2DP target. Net: a legitimately exploitable availability bug for the narrow population of devices shipping experimental A2DP, but low aggregate risk because the feature is non-default and experimental and the attacker must already hold a paired, encrypted BR/EDR link. Note the C:N/I:L split in the input is debatable - the outcome described is purely a crash/hang, so an availability-only impact (I:N/A:H) is at least as defensible.

An attacker already paired over an encrypted BR/EDR link opens the AVDTP signalling channel so the victim's A2DP stack issues bt_a2dp_discover() (arming the 6-second AVDTP_TIMEOUT), then tears the channel down without responding and reconnects within the timeout window. The reconnect path memset()s the bt_a2dp struct while its timeout work item is still linked in the kernel's global timeout list, and the subsequent reschedule corrupts that list, hanging or crashing the whole device. No public exploit code was identified in the provided data; exploitation is deterministic (AC:L) because the attacker controls both the disconnect and reconnect timing.