Is CVE-2026-19938 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-19938 being exploited in the wild.

How severe is CVE-2026-19938?

Medium severity, with a CVSS score of 5.9, published 13 October 2026.

Which products and versions are affected?

Zephyr RTOS versions with CONFIG_BT_SIGNING enabled.

Is there a fix for CVE-2026-19938?

No fixed version is recorded yet. Disable CONFIG_BT_SIGNING if signed writes are not required, or restrict pairing to peers that accept and negotiate CSRK (signing key) distribution. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-19938 attacked?

It is attacked from the adjacent network, in an operating system.

Am I affected by CVE-2026-19938?

Check whether you run Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-19938: Zephyr Bluetooth host ATT buffer use-after-free in signed write path

CVE-2026-19938 · Severity: medium · CVSS 5.9 · Published 2026-10-13

Zephyr's Bluetooth stack incorrectly manages memory when an authenticated write fails due to missing signing credentials. An attacker can trigger buffer mismanagement by pairing without accepting signing keys or keeping a link unencrypted, causing the stack to crash, corrupt internal lists, or send garbled wireless packets to other devices.

Technologies: Zephyr RTOS. Vendors: Zephyr.

Quick answers

Is CVE-2026-19938 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-19938 being exploited in the wild.
How severe is CVE-2026-19938?: Medium severity, with a CVSS score of 5.9, published 13 October 2026.
Which products and versions are affected?: Zephyr RTOS versions with CONFIG_BT_SIGNING enabled.
Is there a fix for CVE-2026-19938?: No fixed version is recorded yet. Disable CONFIG_BT_SIGNING if signed writes are not required, or restrict pairing to peers that accept and negotiate CSRK (signing key) distribution.</anigation> </invoke> If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-19938 attacked?: It is attacked from the adjacent network, in an operating system.
Am I affected by CVE-2026-19938?: Check whether you run Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Disable CONFIG_BT_SIGNING if signed writes are not required, or restrict pairing to peers that accept and negotiate CSRK (signing key) distribution.</anigation> </invoke>

Technical details

The vulnerability is a use-after-free in chan_send() within subsys/bluetooth/host/att.c when BT_ATT_OP_SIGNED_WRITE_CMD fails signing via bt_smp_sign(). The function incorrectly calls net_buf_unref() on error instead of retaining caller ownership, violating the documented contract. Callers expect to own the buffer on failure and attempt to re-queue or retry it, leading to list corruption, double-free, and out-of-bounds writes when buffers are reissued or retried.

Affected products

Zephyr RTOS versions with CONFIG_BT_SIGNING enabled

Timeline

2026-10-13: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.