12 matches found
CVE-2026-82389
In the Bluetooth Classic Hands-Free Profile Audio Gateway role, hfpagcreate in subsys/bluetooth/host/classic/hfpag.c starts an SDP discovery toward the peer, which links the embedded ag-sdpparam.node into the SDP client's pending request list in subsys/bluetooth/host/classic/sdp.c. If the...
CVE-2026-82389 Bluetooth Classic HFP AG wipes an object still linked in the SDP request list on connect failure, causing a NULL dereference
In the Bluetooth Classic Hands-Free Profile Audio Gateway role, hfpagcreate in subsys/bluetooth/host/classic/hfpag.c starts an SDP discovery toward the peer, which links the embedded ag-sdpparam.node into the SDP client's pending request list in subsys/bluetooth/host/classic/sdp.c. If the...
EUVD-2026-109975
In the Bluetooth Classic Hands-Free Profile Audio Gateway role, hfpagcreate in subsys/bluetooth/host/classic/hfpag.c starts an SDP discovery toward the peer, which links the embedded ag-sdpparam.node into the SDP client's pending request list in subsys/bluetooth/host/classic/sdp.c. If the...
CVE-2026-82389 Bluetooth Classic HFP AG wipes an object still linked in the SDP request list on connect failure, causing a NULL dereference
In the Bluetooth Classic Hands-Free Profile Audio Gateway role, hfpagcreate in subsys/bluetooth/host/classic/hfpag.c starts an SDP discovery toward the peer, which links the embedded ag-sdpparam.node into the SDP client's pending request list in subsys/bluetooth/host/classic/sdp.c. If the...
CVE-2026-82389 Bluetooth Classic HFP AG wipes an object still linked in the SDP request list on connect failure, causing a NULL dereference
In the Bluetooth Classic Hands-Free Profile Audio Gateway role, hfpagcreate in subsys/bluetooth/host/classic/hfpag.c starts an SDP discovery toward the peer, which links the embedded ag-sdpparam.node into the SDP client's pending request list in subsys/bluetooth/host/classic/sdp.c. If the...
CVE-2026-82389
The Zephyr RTOS Bluetooth stack is vulnerable to a NULL pointer dereference in the Bluetooth Classic Hands-Free Profile (HFP) Audio Gateway role. The root cause is that bt_hfp_ag_connect() performs a memset() on the entire AG object upon a failed bt_rfcomm_dlc_connect() call, while an embedded no...
Zephyr Project Zephyr resource management error vulnerability
In Zephyr Project, versions 4.4.0 through 4.5.0 contain a resource management error vulnerability. This vulnerability arises because, when SDP discovery is incomplete, bthfphfconnect fails to properly initialize the HFP Hands-Free object by using memset. As a result, nodes in the SDP client reque...
CVE-2026-19940 Bluetooth HFP AG reuses a connection slot while a delayable work item is still armed, corrupting kernel timeout bookkeeping
The Bluetooth Classic Hands-Free Profile Audio Gateway implementation in subsys/bluetooth/host/classic/hfpag.c keeps its struct bthfpag objects in a static pool indexed by ACL connection index. On link teardown, hfpagdisconnected cancels ag-txwork and the per-call work items and then clears...
EUVD-2026-98925
The Bluetooth Classic Hands-Free Profile Audio Gateway implementation in subsys/bluetooth/host/classic/hfpag.c keeps its struct bthfpag objects in a static pool indexed by ACL connection index. On link teardown, hfpagdisconnected cancels ag-txwork and the per-call work items and then clears...
CVE-2026-19940
The Bluetooth Classic Hands-Free Profile Audio Gateway implementation in subsys/bluetooth/host/classic/hfp_ag.c is vulnerable to a memory corruption issue. When a link is torn down, the hfp_ag_disconnected() function fails to cancel the ag->ongoing_call_work item. If a new connection reuses th...
CVE-2026-19940 Bluetooth HFP AG reuses a connection slot while a delayable work item is still armed, corrupting kernel timeout bookkeeping
The Bluetooth Classic Hands-Free Profile Audio Gateway implementation in subsys/bluetooth/host/classic/hfpag.c keeps its struct bthfpag objects in a static pool indexed by ACL connection index. On link teardown, hfpagdisconnected cancels ag-txwork and the per-call work items and then clears...
CVE-2026-19940 Bluetooth HFP AG reuses a connection slot while a delayable work item is still armed, corrupting kernel timeout bookkeeping
The Bluetooth Classic Hands-Free Profile Audio Gateway implementation in subsys/bluetooth/host/classic/hfpag.c keeps its struct bthfpag objects in a static pool indexed by ACL connection index. On link teardown, hfpagdisconnected cancels ag-txwork and the per-call work items and then clears...