{"id":"CVE-2026-77684","kind":"vulnerability","aliases":["CVE-2026-77684"],"related":[],"title":"Zephyr Bluetooth HFP: remote peer can exhaust buffers and halt Bluetooth","description":"The Bluetooth Classic Hands-Free Profile HF role in subsys/bluetooth/host/classic/hfp_hf.c does not release the AT command buffers that are still queued on hf->tx_pending when the RFCOMM DLC goes down. hfp_hf_disconnected() only cancelled the work items and cleared hf->acl, and no other code path ever dequeues those buffers, so each one is permanently lost from the fixed hf_pool (CONFIG_BT_MAX_CONN + 1 buffers, i.e. two in the default configuration). The same function also left BT_HFP_HF_FLAG_CONNECTED set, and hfp_hf_create() wiped the object with memset() as soon as hf->acl was NULL, without checking whether hf->work, hf->slc_work or hf->deferred_work was still pending or running.\n\nThe remote Audio Gateway peer controls the trigger end to end and needs no application involvement: an unsolicited +BCS: 1 response makes bcs_handle() call bt_hfp_hf_select_codec() and queue an AT+BCS buffer, which cannot be transmitted while BT_HFP_HF_FLAG_RX_ONGOING is set, and an immediately following RFCOMM DISC strands that buffer. Repeating the connect / +BCS / disconnect cycle a couple of times empties hf_pool for good.\n\nWith the pool exhausted, HFP command sending fails permanently, and because hfp_hf_send_cmd() allocates with K_FOREVER (bt_rfcomm_create_pdu() → bt_conn_create_pdu()) from the Bluetooth RX context — where that timeout is not downgraded to K_NO_WAIT — one further +BCS from the peer parks the Bluetooth RX thread inside net_buf_alloc() with no possible waker, halting all HCI event processing until the device is rebooted. Separately, reusing the HF slot while a work handler was still queued or running allowed memset() to wipe live k_work items out from under the system workqueue, corrupting shared kernel workqueue state. Exploitation requires an established HFP session (for SSP devices L2CAP enforces authentication before the RFCOMM channel is reachable) and a build with CONFIG_BT_HFP_HF enabled.","summary":"The Zephyr Bluetooth Classic Hands-Free Profile role fails to free queued AT command buffers when the RFCOMM link drops, and reuses the slot while work items are still live. A paired remote Audio Gateway can repeat connect, unsolicited +BCS and disconnect cycles to empty the buffer pool, after which one more +BCS halts all HCI event processing until reboot.","severity":"medium","cvss":5.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bluetooth","embedded","hfp","runtime","zephyr"],"not_affected_if":["auth-required-pairing","bt-hfp-hf-disabled","no-bluetooth-classic"],"how_to_check":"- Check whether the build enables `CONFIG_BT_HFP_HF` (for example in the project's `prj.conf` or Kconfig output)\n- Check the Zephyr version in use with `west list zephyr` or the `VERSION` file and compare it against the fixed release listed in the NVD entry\n- unknown for the exact affected version range","fix":"- Update Zephyr to a release that includes the fix for hfp_hf.c, as referenced in the NVD entry\n- If the update cannot be applied yet, disable the feature with `CONFIG_BT_HFP_HF=n` when Hands-Free profile use is not needed\n- unknown for the specific fixed version number, which the sources do not state","status":"open","published_at":"2026-10-19T23:17:37+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","triaged_at":"2026-10-25T04:10:29+00:00","updated_at":"2026-10-25T04:10:29+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-25T04:10:29Z","model":"claude-haiku-5-5","output":{"fix":"- Update Zephyr to a release that includes the fix for hfp_hf.c, as referenced in the NVD entry\n- If the update cannot be applied yet, disable the feature with `CONFIG_BT_HFP_HF=n` when Hands-Free profile use is not needed\n- unknown for the specific fixed version number, which the sources do not state","reach":"network","title":"Zephyr Bluetooth HFP: remote peer can exhaust buffers and halt Bluetooth","impact":"medium","summary":"The Zephyr Bluetooth Classic Hands-Free Profile role fails to free queued AT command buffers when the RFCOMM link drops, and reuses the slot while work items are still live. A paired remote Audio Gateway can repeat connect, unsolicited +BCS and disconnect cycles to empty the buffer pool, after which one more +BCS halts all HCI event processing until reboot.","category":"runtime","nicknames":[],"who_cares":["zephyr","embedded","bluetooth","hfp"],"confidence":0.7,"needs_auth":"yes","worst_case":"Bluetooth stack halts until reboot, and kernel workqueue state may be corrupted.","analyst_note":"Fixed version and exploitability details are not in the sources; check the NVD entry and the Zephyr security advisory for the patched release.","how_to_check":"- Check whether the build enables `CONFIG_BT_HFP_HF` (for example in the project's `prj.conf` or Kconfig output)\n- Check the Zephyr version in use with `west list zephyr` or the `VERSION` file and compare it against the fixed release listed in the NVD entry\n- unknown for the exact affected version range","needs_analyst":true,"not_affected_if":["bt-hfp-hf-disabled","no-bluetooth-classic","auth-required-pairing"],"who_is_affected":"Devices running Zephyr with Bluetooth Classic and the HFP Hands-Free role enabled, which is the role that connects to a phone or other Audio Gateway. Exposure needs an established HFP session, and for SSP devices authentication is enforced before the RFCOMM channel is reachable. Systems without CONFIG_BT_HFP_HF enabled, or without Bluetooth Classic, are not affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000808,"input_tokens":3995,"output_tokens":818,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-77684':14A,17A '1':152C,223C 'acl':127C,184C 'alloc':292C,333C 'allow':362C 'also':163C 'applic':218C 'audio':57B,206C 'authent':392C 'bcs':63B,76B,222C,226C,238C,265C,321C 'bluetooth':2A,11A,18B,25B,85C,306C,327C 'bt':149C,165C,229C,245C,296C,300C,404C 'buf':332C 'buffer':8A,38B,70B,101C,136C,153C,239C,261C 'build':401C 'call':228C 'cancel':120C 'cannot':241C 'channel':396C 'check':188C 'classic':26B,86C 'clear':125C 'cmd':291C 'code':131C 'codec':233C 'command':37B,100C,282C 'config':148C,403C 'configur':159C 'conn':151C,301C 'connect':61B,169C,264C 'context':308C 'control':209C 'corrupt':376C 'coupl':269C 'creat':174C,298C,302C 'cve':12A,15A 'cycl':66B,267C 'default':158C 'defer':197C 'dequeu':134C 'devic':345C,389C 'disc':258C 'disconnect':65B,118C,266C 'dlc':113C 'downgrad':314C 'drop':43B 'embed':19B 'empti':68B,272C 'enabl':407C 'end':212C,214C 'enforc':391C 'establish':384C 'event':80B,341C 'ever':133C 'exhaust':7A,280C 'exploit':381C 'fail':32B,284C 'fix':145C 'flag':168C,248C 'follow':256C 'forev':295C 'free':29B,34B,89C 'function':162C 'gateway':58B,207C 'goe':114C 'good':276C 'halt':10A,77B,338C 'hand':28B,88C 'handl':227C 'handler':356C 'hands-fre':27B,87C 'hci':79B,340C 'hf':91C,107C,117C,126C,146C,167C,173C,183C,190C,192C,196C,231C,247C,273C,289C,351C,406C 'hfp':3A,20B,116C,166C,172C,230C,246C,281C,288C,385C,405C 'i.e':154C 'immedi':255C 'insid':330C 'involv':219C 'item':50B,123C,369C 'k':294C,316C,367C 'kernel':378C 'l2cap':390C 'left':164C 'link':42B 'live':53B,366C 'lost':142C 'make':225C 'max':150C 'memset':179C,363C 'need':216C 'net':331C 'null':186C 'object':177C 'one':74B,139C,319C 'ongo':250C 'pair':55B 'park':325C 'path':132C 'pdu':299C,303C 'peer':5A,208C,324C 'pend':109C,201C 'perman':141C,285C 'pool':71B,147C,274C,279C 'possibl':336C 'process':81B,342C 'profil':30B,90C 'queu':35B,105C,359C 'queue':235C 'reachabl':398C 'reboot':83B,347C 'releas':97C 'remot':4A,56B,205C 'repeat':60B,262C 'requir':382C 'respons':224C 'reus':45B,349C 'rfcomm':41B,112C,257C,297C,395C 'role':31B,92C 'run':203C,361C 'runtim':21B 'rx':249C,307C,328C 'select':232C 'send':283C,290C 'separ':348C 'session':386C 'set':170C,252C 'share':377C 'slc':193C 'slot':47B,352C 'soon':181C 'ssp':388C 'state':380C 'still':52B,104C,200C,358C 'strand':259C 'subsys/bluetooth/host/classic/hfp_hf.c':94C 'system':374C 'thread':329C 'time':271C 'timeout':311C 'transmit':243C 'trigger':211C 'two':155C 'tx':108C 'unsolicit':62B,221C 'wait':318C 'waker':337C 'whether':189C 'wipe':175C,365C 'without':187C 'work':49B,122C,191C,194C,198C,355C,368C 'workqueu':375C,379C 'zephyr':1A,22B,24B","nicknames":[],"mitigations":[],"who_affected":"Devices running Zephyr with Bluetooth Classic and the HFP Hands-Free role enabled, which is the role that connects to a phone or other Audio Gateway. Exposure needs an established HFP session, and for SSP devices authentication is enforced before the RFCOMM channel is reachable. Systems without CONFIG_BT_HFP_HF enabled, or without Bluetooth Classic, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T23:17:37+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvss_by":"vulnerabilities@zephyrproject.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-77684","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77684","severity":null,"published_at":"2026-10-19T23:17:37+00:00","modified_at":"2026-10-20T20:17:25+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}