CVE-2026-19938

The Bluetooth host's ATT transmit path releases a buffer it does not own when signing fails. chansend in subsys/bluetooth/host/att.c documents and every other error exit implements the contract that on failure the caller retains ownership of the netbuf; the BTATTOPSIGNEDWRITECMD branch instead...

CVE-2026-19938

The Bluetooth host stack is vulnerable to a use-after-free and memory corruption in the ATT transmit path. Specifically, in subsys/bluetooth/host/att.c, the BT_ATT_OP_SIGNED_WRITE_CMD branch incorrectly calls net_buf_unref(buf) when bt_smp_sign() fails. This violates the established contract wher...