CVE-2026-82388

bthfphfconnect in subsys/bluetooth/host/classic/hfphf.c allocates the per-connection HFP Hands-Free object with hfphfcreate, which starts an SDP discovery by passing the object's embedded hf-sdpparam to btsdpdiscover. That call links the caller-owned parameter block into the SDP client's request...

CVE-2026-82388

The Bluetooth Classic host in Zephyr OS is vulnerable to a use-after-free flaw in the bt_hfp_hf_connect() function. When bt_rfcomm_dlc_connect() fails—which can be triggered by a remote device providing an out-of-range RFCOMM channel—the system wipes the HFP Hands-Free object while an SDP discove...

CVE-2026-82388 Use of a released HFP HF object after a failed RFCOMM connect in the Bluetooth Classic host

bthfphfconnect in subsys/bluetooth/host/classic/hfphf.c allocates the per-connection HFP Hands-Free object with hfphfcreate, which starts an SDP discovery by passing the object's embedded hf-sdpparam to btsdpdiscover. That call links the caller-owned parameter block into the SDP client's request...

EUVD-2026-109974

bthfphfconnect in subsys/bluetooth/host/classic/hfphf.c allocates the per-connection HFP Hands-Free object with hfphfcreate, which starts an SDP discovery by passing the object's embedded hf-sdpparam to btsdpdiscover. That call links the caller-owned parameter block into the SDP client's request...