CVE-2026-85033

The AVRCP Target role in subsys/bluetooth/host/classic/avrcp.c keeps its vendor-dependent response transmit state in a per-connection object selected by connection index getavrcptg, with the per-transfer context tid, sentlen, and the BTAVRCPTGFLAGTXONGOING flag stored in the userdata of the queue...

CVE-2026-85033 Bluetooth Classic AVRCP Target: missing TX cleanup on disconnect permanently stalls vendor-dependent responses and leaks them to the next peer

The AVRCP Target role in subsys/bluetooth/host/classic/avrcp.c keeps its vendor-dependent response transmit state in a per-connection object selected by connection index getavrcptg, with the per-transfer context tid, sentlen, and the BTAVRCPTGFLAGTXONGOING flag stored in the userdata of the queue...

CVE-2026-85033

The AVRCP Target role in subsys/bluetooth/host/classic/avrcp.c is vulnerable to a denial of service and information leak due to incomplete cleanup during disconnection. Because avrcp_disconnected() fails to cancel tg->vd_rsp_tx_work or release pending buffers, a dropped link during a fragmente...