CVE-2026-19939
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
In the AVDTP signalling layer of the Zephyr RTOS Bluetooth stack, the L2CAP disconnect handler (bt_avdtp_l2cap_disconnected) failed to cancel the armed delayed timeout_work, leaving it linked in the kernel's global timeout list. When the bt_avdtp session struct is zeroed by memset() on reconnect, the kernel treats the still-linked timeout node as free, corrupting the global timeout list and causing a system-wide crash or hang. The vulnerability requires CONFIG_BT_A2DP (experimental) to be enabled and an encrypted BR/EDR link.
Risk Assessment
A remote attacker within Bluetooth range can trigger a crash or hang of the entire system (denial of service), not just the A2DP session, because a core kernel data structure used by all timers and scheduling is corrupted. It requires an encrypted BR/EDR link and the experimental A2DP support to be enabled.
Recommendation
Update to a version containing the fix that cancels session->timeout_work at the top of bt_avdtp_l2cap_disconnected() and moves k_work_init_delayable() into the session-establishment paths (bt_avdtp_connect() and bt_avdtp_l2cap_accept()). If updating is not possible, consider disabling CONFIG_BT_A2DP until the fix is deployed.
Related vulnerabilities
- CVE-2026-93475Critical
The X.509 parser in NetX Secure accepts an RSA public key of any size, but signature-verification paths decrypt into fixed-size buffers dimensioned for the NX_CRYPTO_MAX_RSA_MODULUS_SIZE default of 4096 bits. A certificate with a larger modulus causes an out-of-bounds write past a file-scope static during ordinary certificate-chain verification, reachable pre-authentication.
- CVE-2026-86471Critical
An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server admin to run arbitrary shell commands as the CouchDB operating system user.
- CVE-2026-113703Critical
SuggestArr before 3.0.0 contains an authentication bypass in its local_bypass mode where enforce_authentication() in api_service/auth/middleware.py trusts the client-controlled request.remote_addr value, derived from the spoofable X-Forwarded-For header due to ProxyFix(x_for=1) configuration. Attackers can send a request with X-Forwarded-For set to a trusted CIDR address such as 127.0.0.1 to gain an unauthenticated admin session.
- CVE-2026-113678Critical
Froxlor before 2.3.15 contains a symlink following vulnerability in Statistics::makeChownWithNewStats that allows authenticated customers to take ownership of arbitrary host directories by abusing the root-run traffic cron. Attackers can replace the goaccess statistics directory in their document root with a symlink, causing chown -R to hand root-owned trees to them.
- CVE-2026-103119Critical
A buffer under-read vulnerability in Apache Tomcat means a large non-blocking write could result in the response body being split between the current request and the next request on that connection, most likely causing failure of the second request and possible leakage of data from the first response to the second.
- CVE-2026-113620Critical
In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, operator WebSocket upgrades on the exec and log routes do not verify the bearer JWT. The payload is decoded and its groups or roles are used as RBAC subjects. A self-minted token whose groups contain admin matches the built-in admin role, with no account and no RoleBinding.
- CVE-2026-113391Critical
In DrayTek Vigor2960 1.5.1.6 Revision 8218, the uploadlangs function in /cgi-bin/mainfunction.cgi of the Upload Endpoint component allows command injection. The attack can be executed remotely and the exploit has been publicly disclosed and may be used.
- CVE-2026-113390Critical
In DrayTek Vigor2960 1.5.1.6 Revision 8218, the sub_182B0 function in /cgi-bin/mainfunction.cgi of the CGI Interface component allows OS command injection via manipulation of the usefile/usescript/option argument. Remote exploitation is possible and the exploit has been published and may be used.
- CVE-2026-113389Critical
In DrayTek Vigor2960 1.5.1.6 Revision 8218, the set_table function in /cgi-bin/mainfunction.cgi of the CGI Process component allows command injection via manipulation of the sectiontype argument. The attack may be launched remotely and the exploit is now public and may be used.
- CVE-2026-105312Critical
A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container image. The operator deploys this image into a pod whose ServiceAccount is bound via ClusterRoleBinding to a ClusterRole granting cluster-wide get/list/watch on all Strimzi CRDs (including KafkaUsers), patch on Kafkas/KafkaRebalances, and cluster-monitoring-view. The attacker's code reads the projected SA token and gains cross-tenant Strimzi control-plane read+write access.
Original NVD description (English source)
The AVDTP signalling layer arms a 6-second command timeout (AVDTP_TIMEOUT) in avdtp_send_cmd() whenever the local device issues an AVDTP request. Every response handler in subsys/bluetooth/host/classic/avdtp.c cancels session->timeout_work before clearing the pending request, but bt_avdtp_l2cap_disconnected() only cleared session->req and left the delayable work armed. The struct bt_avdtp session is the first member of struct bt_a2dp, whose instances live in a static per-connection array, and a2dp_get_connection() in subsys/bluetooth/host/classic/a2dp.c wipes a slot with memset() as soon as session->br_chan.chan.conn is NULL — which the L2CAP layer arranges immediately after the disconnect callback returns. A remote Bluetooth BR/EDR peer triggers the condition by opening the AVDTP signalling channel, letting the local application issue an AVDTP procedure (the standard A2DP flow issues bt_a2dp_discover() from the connected callback), then tearing the signalling channel down without responding and re-opening it within the remaining timeout window. The reconnect reaches a2dp_accept() → a2dp_get_connection(), which zeroes the whole struct bt_a2dp while the work item's struct _timeout is still linked into the kernel's global timeout list. Both the disconnect and the reconnect instants are chosen by the attacker, so no race has to be won; an encrypted BR/EDR link is required, and CONFIG_BT_A2DP (experimental) must be enabled. With the default CONFIG_TIMEOUT_BACKEND_DLIST backend the kernel decides a timeout is inactive by testing whether its list node is linked, so after the memset() the kernel treats a node that is still on the global timeout list as free: the announce path pops a node whose links and handler pointer are NULL, and the next bt_work_reschedule() on the recycled session re-inserts the same node into a list that already contains it. The consequence is corruption of the single kernel data structure every timer, timeslice and sleep depends on — writes through zeroed or stale list pointers and a NULL handler dispatch — producing a system-wide crash or hang rather than a fault confined to the A2DP session. The fix cancels session->timeout_work at the top of bt_avdtp_l2cap_disconnected() and moves k_work_init_delayable() from avdtp_send_cmd() to the session-establishment paths bt_avdtp_connect() and bt_avdtp_l2cap_accept(), so the work item is always initialized before a disconnect callback can run.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS