CVE-2026-19935 | ZephyrProject Zephyr up to 4.4.2 L2CAP l2cap.c l2cap_rx_process rx_work use after free

October 11, 2026 Yanac

A vulnerability classified as very critical has been found in ZephyrProject Zephyr up to 4.4.2. This affects the function l2cap_rx_process of the file subsys/bluetooth/host/l2cap.c of the component L2CAP. This manipulation of the argument rx_work causes use after free.

This vulnerability is tracked as CVE-2026-19935. The attack is possible to be carried out remotely. No exploit exists.

It is suggested to install a patch to address this issue.VulDB Recent EntriesRead More