CVE-2026-19938 | CVSS: 5.9 | 严重级别: MEDIUM
The Bluetooth host's ATT transmit path releases a buffer it does not own when signing fails. chan_send() in subsys/bluetooth/host/att.c documents (and every other error exit implements) the contract that on failure the caller retains ownership of the net_buf; the BT_ATT_OP_SIGNED_WRITE_CMD branch instead called net_buf_unref(buf) when bt_smp_sign() returned an error and then returned that error to the caller. The callers act on the contract: process_queue() re-queues the buffer with k_queue_prepend(), bt_att_chan_send_rsp() puts it back on chan->tx_queue, bt_att_chan_req_send() restores it int
参考链接:
• https://github.com/zephyrproject-rtos/zephyr/commit/ba8627d91c8ce15c26224cbc7f7f
• https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-p3r4-qw98-
📌 数据来源: NVD 官方