The AVDTP signalling layer in Zephyr RTOS schedules a 6‑second command timeout whenever a local device sends an AVDTP request. The code clears the timeout work item when handling the corresponding response, but during a disconnect the work item remains armed. If a remote Bluetooth BR/EDR peer closes the signalling channel and then re‑opens it before the timeout elapses, the session data structure is zeroed by the acceptance routine while the delayed work is still linked in the kernel’s global timeout list. The kernel interprets this stale list node as a free entry, leading to corruption of the timeout list that is used by every timer, timeslice, and sleep. The corruption manifests as a system‑wide crash or hang, not merely a fault confined to the A2DP session.

Devices running the Zephyr RTOS with Bluetooth Classic support and the experimental A2DP profile enabled are vulnerable. The issue is triggered only when CONFIG_BT_A2DP is set and an encrypted BR/EDR link is available. The vulnerability is present in Zephyr revisions that include the affected avdtp.c and a2dp.c code paths; the fix is included in the commit referenced in the CVE advisory.

The CVSS score of 6.3 indicates a moderate severity, but the exploit can be performed remotely over a Bluetooth link that the attacker can establish. The lack of an EPSS score and absence from the CISA KEV catalog suggest that exploitation is not widely observed yet. Nevertheless, because the bug leads to a kernel timeout‑list corruption, any successful exploitation results in denial‑of‑service through a system crash or hang. The attack does not require elevated privileges on the device, so it is sufficient that the attacker can pair or communicate with the target over Bluetooth Classic.