CVE-2026-85033 Bluetooth Classic AVRCP Target: missing TX cleanup on disconnect permanently stalls vendor-dependent responses and leaks them to the next peer

The AVRCP Target role in subsys/bluetooth/host/classic/avrcp.c keeps its vendor-dependent response transmit state in a per-connection object selected by connection index getavrcptg, with the per-transfer context tid, sentlen, and the BTAVRCPTGFLAGTXONGOING flag stored in the userdata of the queue...

CVE-2026-85033

The AVRCP Target role in subsys/bluetooth/host/classic/avrcp.c is vulnerable to a denial of service and information leak due to incomplete cleanup during disconnection. Because avrcp_disconnected() fails to cancel tg->vd_rsp_tx_work or release pending buffers, a dropped link during a fragmente...

bluez

BlueZ - Bluetooth protocol stack for Linux Copyright C 2000-2001 Qualcomm Incorporated Copyright C 2002-2003 Maxim Krasnyansky [email protected] Copyright C 2002-2010 Marcel Holtmann [email protected] Compilation and installation In order to compile Bluetooth utilities you need followin...

CVE-2026-11109-Bluetooth-Classic-KNOB-Attack-Key-Negotiation-of-Bluetooth-

CVE-2026-11109 – Bluetooth Classic KNOB Attack Key Negotiation of Bluetooth Program Code Python Simulated knobattacksim.py - Simulates negotiation of encryption key size to 1 byte import random, hashlib class BluetoothDevice: def negotiatekeysizeself, proposedsize: Vulnerable: accepts any key siz...

JXL_Infotainment_CVE-2025-63895

JXLInfotainmentCVE-2025-63895 CVE-2025-63895 Attack Name 📂 Additional Details Afftected product Affected Components Bluetooth Classic version 5.0 Bluetooth firmware stack LMP implementation Infotainment Bluetooth service Attack Vector An attacker within Bluetooth range can exploit this issue by...

Linux Distros Unpatched Vulnerability : CVE-2026-82389

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Bluetooth Classic Hands-Free Profile Audio Gateway role, hfpagcreate in subsys/bluetooth/host/classic/hfpag.c starts an SDP discovery toward the peer,...

CVE-2026-82389

In the Bluetooth Classic Hands-Free Profile Audio Gateway role, hfpagcreate in subsys/bluetooth/host/classic/hfpag.c starts an SDP discovery toward the peer, which links the embedded ag-sdpparam.node into the SDP client's pending request list in subsys/bluetooth/host/classic/sdp.c. If the...

CVE-2026-82389

In the Bluetooth Classic Hands-Free Profile Audio Gateway role, hfpagcreate in subsys/bluetooth/host/classic/hfpag.c starts an SDP discovery toward the peer, which links the embedded ag-sdpparam.node into the SDP client's pending request list in subsys/bluetooth/host/classic/sdp.c. If the...

UBUNTU-CVE-2026-82389

In the Bluetooth Classic Hands-Free Profile Audio Gateway role, hfpagcreate in subsys/bluetooth/host/classic/hfpag.c starts an SDP discovery toward the peer, which links the embedded ag-sdpparam.node into the SDP client's pending request list in subsys/bluetooth/host/classic/sdp.c. If the...

EUVD-2026-109975

In the Bluetooth Classic Hands-Free Profile Audio Gateway role, hfpagcreate in subsys/bluetooth/host/classic/hfpag.c starts an SDP discovery toward the peer, which links the embedded ag-sdpparam.node into the SDP client's pending request list in subsys/bluetooth/host/classic/sdp.c. If the...

CVE-2026-82389 Bluetooth Classic HFP AG wipes an object still linked in the SDP request list on connect failure, causing a NULL dereference

In the Bluetooth Classic Hands-Free Profile Audio Gateway role, hfpagcreate in subsys/bluetooth/host/classic/hfpag.c starts an SDP discovery toward the peer, which links the embedded ag-sdpparam.node into the SDP client's pending request list in subsys/bluetooth/host/classic/sdp.c. If the...

CVE-2026-82389 Bluetooth Classic HFP AG wipes an object still linked in the SDP request list on connect failure, causing a NULL dereference

In the Bluetooth Classic Hands-Free Profile Audio Gateway role, hfpagcreate in subsys/bluetooth/host/classic/hfpag.c starts an SDP discovery toward the peer, which links the embedded ag-sdpparam.node into the SDP client's pending request list in subsys/bluetooth/host/classic/sdp.c. If the...

CVE-2026-82389

The Zephyr RTOS Bluetooth stack is vulnerable to a NULL pointer dereference in the Bluetooth Classic Hands-Free Profile (HFP) Audio Gateway role. The root cause is that bt_hfp_ag_connect() performs a memset() on the entire AG object upon a failed bt_rfcomm_dlc_connect() call, while an embedded no...

CVE-2026-82389 Bluetooth Classic HFP AG wipes an object still linked in the SDP request list on connect failure, causing a NULL dereference

In the Bluetooth Classic Hands-Free Profile Audio Gateway role, hfpagcreate in subsys/bluetooth/host/classic/hfpag.c starts an SDP discovery toward the peer, which links the embedded ag-sdpparam.node into the SDP client's pending request list in subsys/bluetooth/host/classic/sdp.c. If the...

CVE-2026-82388

The Bluetooth Classic host in Zephyr OS is vulnerable to a use-after-free flaw in the bt_hfp_hf_connect() function. When bt_rfcomm_dlc_connect() fails—which can be triggered by a remote device providing an out-of-range RFCOMM channel—the system wipes the HFP Hands-Free object while an SDP discove...

CVE-2026-82388 Use of a released HFP HF object after a failed RFCOMM connect in the Bluetooth Classic host

bthfphfconnect in subsys/bluetooth/host/classic/hfphf.c allocates the per-connection HFP Hands-Free object with hfphfcreate, which starts an SDP discovery by passing the object's embedded hf-sdpparam to btsdpdiscover. That call links the caller-owned parameter block into the SDP client's request...

CVE-2026-82388 Use of a released HFP HF object after a failed RFCOMM connect in the Bluetooth Classic host

bthfphfconnect in subsys/bluetooth/host/classic/hfphf.c allocates the per-connection HFP Hands-Free object with hfphfcreate, which starts an SDP discovery by passing the object's embedded hf-sdpparam to btsdpdiscover. That call links the caller-owned parameter block into the SDP client's request...

CVE-2026-82388 Use of a released HFP HF object after a failed RFCOMM connect in the Bluetooth Classic host

bthfphfconnect in subsys/bluetooth/host/classic/hfphf.c allocates the per-connection HFP Hands-Free object with hfphfcreate, which starts an SDP discovery by passing the object's embedded hf-sdpparam to btsdpdiscover. That call links the caller-owned parameter block into the SDP client's request...

PT-2026-123420

In the Bluetooth Classic Hands-Free Profile Audio Gateway role, hfp ag create in subsys/bluetooth/host/classic/hfp ag.c starts an SDP discovery toward the peer, which links the embedded ag-sdp param. node into the SDP client's pending request list in subsys/bluetooth/host/classic/sdp.c. If the...

CVE-2026-18748

The Bluetooth Classic A2DP host stores a codec Information Element IE in struct bta2dpcodecie, a one-byte len field plus a fixed 8-byte codecie array. When an AVDTP peer sent a codec IE longer than 8 bytes, a2dpprocessconfigind in subsys/bluetooth/host/classic/a2dp.c copied only the first 8 bytes...