Zephyr Discloses Five Embedded and Bluetooth Availability Flaws
Tech GuruQuick Answer
The Zephyr Project published five advisories affecting specific ESP32 I2S and Bluetooth configurations. One issue is rated High and four Medium. Projected Zephyr 4.5.0 was not yet released when verified; inventory exact features and branches, then follow the current advisory patch status without treating the projected version as available.
Identify Exposed Zephyr Features And Confirm Supported Fix Status
What to do now: Inventory firmware branches and enabled ESP32 I2S or Bluetooth features, map each image to the five advisory conditions, confirm the current supported branch patch status, rebuild through the approved supply chain, and validate on representative hardware.
Last verified: 2026-10-12 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Zephyr RTOS ESP32 I2S and Bluetooth host or controller components |
|---|---|
| Advisory | GHSA-5g9q-h8wq-rrf3 / GHSA-6gp4-cwf7-2vp8 / GHSA-6mcj-5jw8-ff36 / GHSA-84v8-vgp5-4vc9 / GHSA-rgw4-3qr8-pp36 |
| CVEs | CVE-2026-19737, CVE-2026-19738, CVE-2026-19739, CVE-2026-19740, CVE-2026-19935 |
| Authoritative release date | 2026-10-11 16:24:23 UTC |
| Authority revision date | 2026-10-11 17:12:32 UTC |
| Affected versions | Zephyr 4.4.0 through 4.4.2 for the ESP32 I2S issue; 2.0.0 through 4.4.2 for the L2CAP CoC issue; and 3.4.0 through 4.4.2 for the three Bluetooth controller issues, subject to each advisory's feature and configuration conditions. |
| Fixed version | Project fixes merged on applicable branches; Zephyr 4.5.0 is projected but was not released when verified, so confirm each advisory's current branch and backport status |
| CVSS base score | 5.5 / 6.5 / 7.5 (CVSS v3.1) |
| CVSS severity | Medium to High |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
The Zephyr Project disclosed one ESP32 I2S denial-of-service path, one Bluetooth L2CAP use-after-free, and three Bluetooth controller retained-node defects. The authority describes availability impact and branch-specific merged or pending patches.
What To Validate Now
- Inventory. Record Zephyr version and commit, board and SoC, CONFIG_USERSPACE and ESP32 I2S direction support, Bluetooth L2CAP dynamic-channel use, controller ISO, connection-update, and PHY-update features, product owner, and deployed firmware provenance.
- Establish applicability. Apply each advisory's version and configuration conditions separately. The broadest version range alone does not make every Zephyr device affected.
- Remediate. Use the current project advisory and supported branch status for each fix. The authority projected 4.5.0 but explicitly said it was not yet released; verify an actual release or approved backport before deployment.
- Validate. Rebuild reproducibly, confirm fix commits or the released version, exercise Bluetooth connection, teardown, update, and recovery paths plus applicable I2S behavior, and monitor representative devices for resets or resource exhaustion.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Patch status differs by branch, and at least one advisory warns of incomplete or pending backport conditions. Do not infer that a merged main-branch commit is a released supported build. Preserve SBOM, configuration, source revision, build attestation, test results, and rollback firmware.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
