Is CVE-2026-19939 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-19939 being exploited in the wild.

How severe is CVE-2026-19939?

Medium severity, with a CVSS score of 6.3, published 13 October 2026.

Which products and versions are affected?

Zephyr Project Zephyr RTOS versions prior to the fix for CVE-2026-19939.

Is there a fix for CVE-2026-19939?

Yes: fixed in Zephyr commit that adds timeout cancellation at the top of bt_avdtp_l2cap_disconnected() and moves k_work_init_delayable() to bt_avdtp_connect() and bt_avdtp_l2cap_accept(). Until then: Disable A2DP support by setting CONFIG_BT_A2DP to off until an update can be applied. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-19939 attacked?

It is attacked from the adjacent network, in an operating system.

Am I affected by CVE-2026-19939?

Check whether you run Zephyr Project Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-19939: Zephyr AVDTP timeout corruption in A2DP session disconnect

CVE-2026-19939 · Severity: medium · CVSS 6.3 · Published 2026-10-13

Zephyr's Bluetooth A2DP audio streaming implementation has a flaw where improperly cleaned up timer state can corrupt the kernel's global timeout list. A remote attacker can trigger this by initiating an audio connection, abruptly disconnecting, and reconnecting within a 6-second window, causing a system-wide crash or hang rather than affecting only the audio session.

Technologies: Zephyr Project Zephyr RTOS. Vendors: Zephyr Project.

Quick answers

Is CVE-2026-19939 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-19939 being exploited in the wild.
How severe is CVE-2026-19939?: Medium severity, with a CVSS score of 6.3, published 13 October 2026.
Which products and versions are affected?: Zephyr Project Zephyr RTOS versions prior to the fix for CVE-2026-19939.
Is there a fix for CVE-2026-19939?: Yes: fixed in Zephyr commit that adds timeout cancellation at the top of bt_avdtp_l2cap_disconnected() and moves k_work_init_delayable() to bt_avdtp_connect() and bt_avdtp_l2cap_accept(). Until then: Disable A2DP support by setting CONFIG_BT_A2DP to off until an update can be applied. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-19939 attacked?: It is attacked from the adjacent network, in an operating system.
Am I affected by CVE-2026-19939?: Check whether you run Zephyr Project Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Zephyr commit that adds timeout cancellation at the top of bt_avdtp_l2cap_disconnected() and moves k_work_init_delayable() to bt_avdtp_connect() and bt_avdtp_l2cap_accept()

Disable A2DP support by setting CONFIG_BT_A2DP to off until an update can be applied.

Technical details

The AVDTP signalling layer arms a 6-second timeout via avdtp_send_cmd(), but the L2CAP disconnect handler fails to cancel the timeout work item before the session structure is memset() to zero when a new connection arrives. This leaves an active work item pointing into freed memory; the kernel's DLIST timeout backend then corrupts its global timer list during the next timeout operation by writing through NULL or stale pointers and dispatching a NULL handler.

Affected products

Zephyr Project Zephyr RTOS versions prior to the fix for CVE-2026-19939

Timeline

2026-10-13: disclosed
2026-10-13: advisory: CVE-2026-19939

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.