Description
The Bluetooth host's ATT transmit path releases a buffer it does not own when signing fails. chan_send() in subsys/bluetooth/host/att.c documents (and every other error exit implements) the contract that on failure the caller retains ownership of the net_buf; the BT_ATT_OP_SIGNED_WRITE_CMD branch instead called net_buf_unref(buf) when bt_smp_sign() returned an error and then returned that error to the caller. The callers act on the contract: process_queue() re-queues the buffer with k_queue_prepend(), bt_att_chan_send_rsp() puts it back on chan->tx_queue, bt_att_chan_req_send() restores it into the request, and att_req_retry() unreferences it — so the already-freed buffer was re-queued, later dereferenced, and eventually freed again.

An ATT Signed Write Command is produced when an application calls bt_gatt_write_without_response_cb() with sign set on an unencrypted connection. bt_smp_sign() fails whenever no local CSRK exists for the peer (-ENOENT), and whether one exists is negotiated with the peer: smp_distribute_keys() stores a local CSRK only when the peer's pairing key-distribution field requests the signing key and bonding was agreed. A peer can therefore pair without accepting the CSRK, pair with No Bonding, remain unpaired, or keep the link unencrypted, and the victim's next signed write takes the failing path. Because struct net_buf's node field is simultaneously the linkage word for the ATT TX FIFO, for the deferred-destroy list used by the att_pool destroy callback att_tx_destroy(), and for the pool free list, the mishandled buffer corrupts these lists and can be re-issued by bt_att_create_pdu() to a new PDU while the ATT TX path still holds it.

The same branch also saved the net_buf_simple_state only after signing, so a buffer restored after a bt_l2cap_send_pdu() failure kept its 12-octet signature; a subsequent retry re-signed it and appended a second signature with net_buf_add(buf, 12) to a buffer that bt_att_create_pdu() sized for exactly one, writing past the end of the pooled buffer in builds where the net_buf tailroom assertion is compiled out.

Impact is host-side memory corruption in the Bluetooth stack: list corruption, a pooled ATT buffer with two owners (wrong PDU contents transmitted, or a double free when the queues are drained at disconnect), and a bounded out-of-bounds write on the retry path — typically observed as a crash or assertion failure. Exposure requires the deprecated CONFIG_BT_SIGNING to be enabled and an application that actually issues signed writes; in that configuration the triggering condition is under the remote peer's control.
Published: 2026-10-12
Score: 5.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Memory Corruption
Action: Immediate Patch
AI Analysis

Impact

A use‑after‑free flaw exists in the Zephyr Bluetooth host when an outgoing ATT Signed Write Command fails to sign. The flaw frees an ATT PDU buffer that the caller still holds, leading to double deallocation and memory corruption. The corrupted pool can generate list corruption, an out‑of‑bounds write on retry, and delivers corrupted or duplicate PDUs. The vulnerability can cause crashes or assertion failures, effectively a denial‑of‑service on the host side.

Affected Systems

Zephyr RTOS, specifically the Bluetooth host stack. The issue is present in all builds that enable CONFIG_BT_SIGNING and compile the affected code path (commit ba8627d91c8ce15c26224cbc7f7f92bb66f56b03 and earlier).

Risk and Exploitability

The CVSS score of 5.9 places this vulnerability in the medium severity range. The EPSS value is currently unavailable, and the flaw is not listed in the CISA KEV catalog. The associated attack vector is remote; an attacker can trigger the flaw by pairing or interacting with the device over an unencrypted link that does not provide a CSRK. When the remote peer sends a signed write on such a link, the failure path is executed, freeing the buffer and leading to corruption. No public exploit is documented, but the conditions can be met on an otherwise Bluetooth‑enabled Zephyr device, making the risk moderate for exposed devices.

Generated by OpenCVE AI on October 13, 2026 at 00:33 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Zephyr to a release that incorporates commit ba8627d91c8ce15c26224cbc7f7f92bb66f56b03 or later.
  • If signed writes are not required for your application, disable CONFIG_BT_SIGNING in the Zephyr configuration to eliminate the vulnerable code path.
  • When signed writes are needed, enforce bonding or key distribution that provides a CSRK – reject or drop signed writes received on an unencrypted connection.
  • Ensure that the firmware rebuild includes net_buf tailroom assertions to detect overruns during development and testing.

Generated by OpenCVE AI on October 13, 2026 at 00:33 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 14 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 02:45:00 +0000

Type Values Removed Values Added
First Time appeared Zephyrproject
Zephyrproject zephyr
Vendors & Products Zephyrproject
Zephyrproject zephyr

Mon, 12 Oct 2026 23:30:00 +0000

Type Values Removed Values Added
Description The Bluetooth host's ATT transmit path releases a buffer it does not own when signing fails. chan_send() in subsys/bluetooth/host/att.c documents (and every other error exit implements) the contract that on failure the caller retains ownership of the net_buf; the BT_ATT_OP_SIGNED_WRITE_CMD branch instead called net_buf_unref(buf) when bt_smp_sign() returned an error and then returned that error to the caller. The callers act on the contract: process_queue() re-queues the buffer with k_queue_prepend(), bt_att_chan_send_rsp() puts it back on chan->tx_queue, bt_att_chan_req_send() restores it into the request, and att_req_retry() unreferences it — so the already-freed buffer was re-queued, later dereferenced, and eventually freed again. An ATT Signed Write Command is produced when an application calls bt_gatt_write_without_response_cb() with sign set on an unencrypted connection. bt_smp_sign() fails whenever no local CSRK exists for the peer (-ENOENT), and whether one exists is negotiated with the peer: smp_distribute_keys() stores a local CSRK only when the peer's pairing key-distribution field requests the signing key and bonding was agreed. A peer can therefore pair without accepting the CSRK, pair with No Bonding, remain unpaired, or keep the link unencrypted, and the victim's next signed write takes the failing path. Because struct net_buf's node field is simultaneously the linkage word for the ATT TX FIFO, for the deferred-destroy list used by the att_pool destroy callback att_tx_destroy(), and for the pool free list, the mishandled buffer corrupts these lists and can be re-issued by bt_att_create_pdu() to a new PDU while the ATT TX path still holds it. The same branch also saved the net_buf_simple_state only after signing, so a buffer restored after a bt_l2cap_send_pdu() failure kept its 12-octet signature; a subsequent retry re-signed it and appended a second signature with net_buf_add(buf, 12) to a buffer that bt_att_create_pdu() sized for exactly one, writing past the end of the pooled buffer in builds where the net_buf tailroom assertion is compiled out. Impact is host-side memory corruption in the Bluetooth stack: list corruption, a pooled ATT buffer with two owners (wrong PDU contents transmitted, or a double free when the queues are drained at disconnect), and a bounded out-of-bounds write on the retry path — typically observed as a crash or assertion failure. Exposure requires the deprecated CONFIG_BT_SIGNING to be enabled and an application that actually issues signed writes; in that configuration the triggering condition is under the remote peer's control.
Title Use-after-free of an ATT PDU buffer when signing an outgoing Bluetooth ATT Signed Write Command fails
Weaknesses CWE-416
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H'}

Subscriptions

Zephyrproject Zephyr
cve-icon MITRE

Status: PUBLISHED

Assigner: zephyr

Published:

Updated: 2026-10-14T19:17:39.405Z

Reserved: 2026-08-15T13:31:20.143Z

Link: CVE-2026-19938

cve-icon Vulnrichment

Updated: 2026-10-14T19:17:34.827Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-13T00:17:01.657

Modified: 2026-10-14T20:17:35.670

Link: CVE-2026-19938

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T02:30:09Z

Weaknesses