CVE-2026-19938: use-after-free in zephyrproject zephyr

The vulnerability arises because the ATT transmit path releases a net_buf buffer it does not own when signing fails in the BT_ATT_OP_SIGNED_WRITE_CMD branch. The callers expect to retain ownership on failure, but the code calls net_buf_unref() prematurely, leading to a use-after-free condition. This corrupts internal linked lists and can cause double frees or out-of-bounds writes when retrying signed writes. The issue manifests when bt_smp_sign() fails due to missing local CSRK, which depends on the peer's pairing and bonding state. The vulnerability impacts the Bluetooth host stack memory integrity and stability under specific configurations.

The vulnerability causes host-side memory corruption in the Zephyr Bluetooth stack, including corrupted linked lists, double frees, and out-of-bounds writes. This can lead to crashes or assertion failures on affected devices. The impact is limited to configurations with the deprecated CONFIG_BT_SIGNING enabled and applications issuing signed writes. There is no confidentiality impact, but integrity is low and availability impact is high due to potential crashes.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider disabling the deprecated CONFIG_BT_SIGNING option and avoid using signed writes on unencrypted connections. Monitor Zephyr project advisories for updates and apply official fixes once released.