CVE-2026-19935: use-after-free in zephyrproject zephyr

The vulnerability occurs in Zephyr's Bluetooth LE host stack where received L2CAP CoC data is queued for deferred processing via a work item embedded in the channel object. When a channel using a dynamic PSM is torn down, the RX FIFO is drained and retransmission-timeout work is canceled, but the RX work item (rx_work) is not canceled. Because the RX work is queued on a different system workqueue than the Bluetooth RX workqueue, a race condition allows the work item to outlive the channel object it references. This leads to use-after-free scenarios when the channel memory is freed or reused, causing memory corruption or workqueue malfunction. The vulnerability can be triggered by a remote unauthenticated peer sending a data K-frame followed immediately by an L2CAP Disconnect Request. The fix involves routing the RX work to the Bluetooth workqueue and explicitly canceling the RX work during channel destruction, ensuring no references survive the released() callback. Configurations without dynamic channels or using only SIG-assigned PSMs are not affected.

Successful exploitation allows a remote unauthenticated attacker with an established L2CAP CoC channel to cause use-after-free conditions, potentially leading to memory corruption, application crashes, or denial of service. The vulnerability affects confidentiality, integrity, and availability of the affected system. There are no known exploits in the wild at this time.

A fix is available that routes the channel RX work to the Bluetooth workqueue and adds an explicit cancellation of the RX work item during channel teardown to prevent use-after-free. Users should upgrade to a Zephyr version later than 4.4.2 where this fix is applied. For configurations without dynamic channels or only using SIG-assigned PSMs (EATT 0x0027, OTS 0x0025), this vulnerability does not apply.