CVE-2026-19940

The Bluetooth Classic Hands-Free Profile Audio Gateway implementation in subsys/bluetooth/host/classic/hfpag.c keeps its struct bthfpag objects in a static pool indexed by ACL connection index. On link teardown, hfpagdisconnected cancels ag-txwork and the per-call work items and then clears...

CVE-2026-19940

The Bluetooth Classic Hands-Free Profile Audio Gateway implementation in subsys/bluetooth/host/classic/hfp_ag.c is vulnerable to a memory corruption issue. When a link is torn down, the hfp_ag_disconnected() function fails to cancel the ag->ongoing_call_work item. If a new connection reuses th...

EUVD-2026-98925

The Bluetooth Classic Hands-Free Profile Audio Gateway implementation in subsys/bluetooth/host/classic/hfpag.c keeps its struct bthfpag objects in a static pool indexed by ACL connection index. On link teardown, hfpagdisconnected cancels ag-txwork and the per-call work items and then clears...

CVE-2026-19940

The Bluetooth Classic Hands-Free Profile Audio Gateway implementation in subsys/bluetooth/host/classic/hfpag.c keeps its struct bthfpag objects in a static pool indexed by ACL connection index. On link teardown, hfpagdisconnected cancels ag-txwork and the per-call work items and then clears...

CVE-2026-19940 Bluetooth HFP AG reuses a connection slot while a delayable work item is still armed, corrupting kernel timeout bookkeeping

The Bluetooth Classic Hands-Free Profile Audio Gateway implementation in subsys/bluetooth/host/classic/hfpag.c keeps its struct bthfpag objects in a static pool indexed by ACL connection index. On link teardown, hfpagdisconnected cancels ag-txwork and the per-call work items and then clears...

PT-2026-111724

The Bluetooth Classic Hands-Free Profile Audio Gateway implementation in subsys/bluetooth/host/classic/hfp ag.c keeps its struct bt hfp ag objects in a static pool indexed by ACL connection index. On link teardown, hfp ag disconnected cancels ag-tx work and the per-call work items and then clears...

CVE-2026-19940: Use After Free

The Bluetooth Classic Hands-Free Profile Audio Gateway implementation in subsys/bluetooth/host/classic/hfpag.c keeps its struct bthfpag objects in a static pool indexed by ACL connection index. On link teardown, hfpagdisconnected cancels ag-txwork and the per-call work items and then clears...