# CVE-2026-19939: Zephyr AVDTP timeout corruption in A2DP session disconnect

Source: https://junglewise.ai/threats/cve-2026-19939-the-avdtp-signalling-layer-arms-a-6-second-command-timeout-avdtp  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-19939 · Severity: medium · CVSS 6.3 · Published 2026-10-13

Zephyr's Bluetooth A2DP audio streaming implementation has a flaw where improperly cleaned up timer state can corrupt the kernel's global timeout list. A remote attacker can trigger this by initiating an audio connection, abruptly disconnecting, and reconnecting within a 6-second window, causing a system-wide crash or hang rather than affecting only the audio session.

Technologies: [Zephyr Project Zephyr RTOS](https://junglewise.ai/threats/technologies/zephyr). Vendors: [Zephyr Project](https://junglewise.ai/threats/vendors/zephyr-project).

## Quick answers

**Is CVE-2026-19939 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-19939 being exploited in the wild.

**How severe is CVE-2026-19939?** Medium severity, with a CVSS score of 6.3, published 13 October 2026.

**Which products and versions are affected?** Zephyr Project Zephyr RTOS versions prior to the fix for CVE-2026-19939.

**Is there a fix for CVE-2026-19939?** Yes: fixed in Zephyr commit that adds timeout cancellation at the top of bt_avdtp_l2cap_disconnected() and moves k_work_init_delayable() to bt_avdtp_connect() and bt_avdtp_l2cap_accept(). Until then: Disable A2DP support by setting CONFIG_BT_A2DP to off until an update can be applied. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-19939 attacked?** It is attacked from the adjacent network, in an operating system.

**Am I affected by CVE-2026-19939?** Check whether you run Zephyr Project Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Zephyr commit that adds timeout cancellation at the top of bt_avdtp_l2cap_disconnected() and moves k_work_init_delayable() to bt_avdtp_connect() and bt_avdtp_l2cap_accept()

Disable A2DP support by setting CONFIG_BT_A2DP to off until an update can be applied.

## Technical details

The AVDTP signalling layer arms a 6-second timeout via avdtp_send_cmd(), but the L2CAP disconnect handler fails to cancel the timeout work item before the session structure is memset() to zero when a new connection arrives. This leaves an active work item pointing into freed memory; the kernel's DLIST timeout backend then corrupts its global timer list during the next timeout operation by writing through NULL or stale pointers and dispatching a NULL handler.

## Affected products

- Zephyr Project Zephyr RTOS versions prior to the fix for CVE-2026-19939

## Timeline

- 2026-10-13: disclosed
- 2026-10-13: advisory: CVE-2026-19939

## Related threats

- [Zephyr ICMP integer underflow in IPv4 option handling](https://junglewise.ai/threats/cve-2026-126957-an-integer-underflow-in-zephyr-s-ipv4-option-handling-allows-a)
- [Zephyr RTOS simulated EEPROM driver integer overflow in range validation](https://junglewise.ai/threats/cve-2026-90833-the-simulated-eeprom-driver-validated-access-ranges-in-eeprom)
- [Zephyr entropy-device uninitialized read in random number generation](https://junglewise.ai/threats/cve-2026-87043-the-entropy-device-random-number-generator-in-subsys-random)
- [Zephyr CAN RX filter use-after-free in can_add_rx_filter_msgq()](https://junglewise.ai/threats/cve-2026-85035-the-can-add-rx-filter-msgq-system-call-installs-a-can-rx-filter)
- [Zephyr GPIO syscall pin validation bypass](https://junglewise.ai/threats/cve-2026-82961-the-gpio-syscall-handlers-in-drivers-gpio-gpio-handlers-c-did-not)