CVE-2026-19940

The Bluetooth Classic Hands-Free Profile Audio Gateway implementation in subsys/bluetooth/host/classic/hfp_ag.c is vulnerable to a memory corruption issue. When a link is torn down, the hfp_ag_disconnected() function fails to cancel the ag->ongoing_call_work item. If a new connection reuses th...