# CVE-2026-19938: Zephyr Bluetooth host ATT buffer use-after-free in signed write path

Source: https://junglewise.ai/threats/cve-2026-19938-the-bluetooth-host-s-att-transmit-path-releases-a-buffer-it-does  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-19938 · Severity: medium · CVSS 5.9 · Published 2026-10-13

Zephyr's Bluetooth stack incorrectly manages memory when an authenticated write fails due to missing signing credentials. An attacker can trigger buffer mismanagement by pairing without accepting signing keys or keeping a link unencrypted, causing the stack to crash, corrupt internal lists, or send garbled wireless packets to other devices.

Technologies: [Zephyr RTOS](https://junglewise.ai/threats/technologies/rtos). Vendors: [Zephyr](https://junglewise.ai/threats/vendors/zephyr).

## Quick answers

**Is CVE-2026-19938 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-19938 being exploited in the wild.

**How severe is CVE-2026-19938?** Medium severity, with a CVSS score of 5.9, published 13 October 2026.

**Which products and versions are affected?** Zephyr RTOS versions with CONFIG_BT_SIGNING enabled.

**Is there a fix for CVE-2026-19938?** No fixed version is recorded yet. Disable CONFIG_BT_SIGNING if signed writes are not required, or restrict pairing to peers that accept and negotiate CSRK (signing key) distribution.</anigation>
</invoke> If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-19938 attacked?** It is attacked from the adjacent network, in an operating system.

**Am I affected by CVE-2026-19938?** Check whether you run Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Disable CONFIG_BT_SIGNING if signed writes are not required, or restrict pairing to peers that accept and negotiate CSRK (signing key) distribution.</anigation>
</invoke>

## Technical details

The vulnerability is a use-after-free in chan_send() within subsys/bluetooth/host/att.c when BT_ATT_OP_SIGNED_WRITE_CMD fails signing via bt_smp_sign(). The function incorrectly calls net_buf_unref() on error instead of retaining caller ownership, violating the documented contract. Callers expect to own the buffer on failure and attempt to re-queue or retry it, leading to list corruption, double-free, and out-of-bounds writes when buffers are reissued or retried.

## Affected products

- Zephyr RTOS versions with CONFIG_BT_SIGNING enabled

## Timeline

- 2026-10-13: disclosed

## Related threats

- [Zephyr Bluetooth HCI USB buffer overflow in controller-to-host path](https://junglewise.ai/threats/cve-2026-79982-the-bluetooth-hci-usb-transport-class-of-the-new-usb-device-stack)
- [Zephyr RTOS PECI driver privilege escalation in peci_transfer()](https://junglewise.ai/threats/cve-2026-19676-the-user-mode-verifier-for-the-peci-transfer-system-call-z-vrfy)
- [Zephyr Bluetooth Mesh Access layer delayable message context leak](https://junglewise.ai/threats/cve-2026-19937-the-bluetooth-mesh-access-layer-delayable-message-machinery-in)
- [Zephyr TCP ISN derivation with all-zero key on entropy failure](https://junglewise.ai/threats/cve-2026-19735-the-rfc-6528-initial-sequence-number-implementation-in-subsys-net)
- [Zephyr RTOS IEEE 802.15.4 integer underflow in frame decryption](https://junglewise.ai/threats/cve-2026-19186-ieee802154-decipher-data-frame-in-subsys-net-l2-ieee802154)