{"id":"CVE-2026-82388","kind":"vulnerability","aliases":["CVE-2026-82388"],"related":[],"title":"Zephyr Bluetooth HFP: failed connect wipes object still linked in SDP list","description":"bt_hfp_hf_connect() in subsys/bluetooth/host/classic/hfp_hf.c allocates the per-connection HFP Hands-Free object with hfp_hf_create(), which starts an SDP discovery by passing the object's embedded hf->sdp_param to bt_sdp_discover(). That call links the caller-owned parameter block into the SDP client's request list (session->reqs in subsys/bluetooth/host/classic/sdp.c). If the subsequent bt_rfcomm_dlc_connect() then failed, the affected code wiped the entire object with (void)memset(new_hf, 0, sizeof(*new_hf)) while that discovery was still outstanding, zeroing the sys_snode_t _node that is still linked in the SDP client's list along with the request's func, uuid and pool pointers, and zeroing the hf->slc_work work item that may already be queued on the system workqueue. The discovery could not be retracted instead: bt_sdp_discover_cancel() is declared in include/zephyr/bluetooth/classic/sdp.h but has no implementation.\n\nThe failing branch is reachable with peer-supplied input. The documented use of bt_hfp_hf_connect() is to pass the RFCOMM channel read out of the remote Audio Gateway's SDP record; neither bt_sdp_get_proto_param() nor bt_hfp_hf_connect() range-checks that value, so a remote device advertising an HFP AG record with an RFCOMM channel outside 1-30 makes bt_rfcomm_dlc_connect() return -EINVAL and drives the local device into the wipe. The same branch is reached without any application misuse when the remote peer controls connection timing, for example when the RFCOMM session is in BT_RFCOMM_STATE_DISCONNECTING or the ACL is dropped between object creation and the RFCOMM call.\n\nOnce the object has been wiped, the Bluetooth host continues to use it: sdp_client_alloc_buf() dereferences session->param->pool, which is now NULL, and the SDP receive paths call session->param->func() through a null function pointer, neither of which is NULL-checked. Because the wipe also clears hf->acl, the pool slot is considered free and a retry or an incoming HFP connection re-appends the same still-linked list node, turning session->reqs into a self-referential list that the host's list walkers never leave. The result is a fault or an unrecoverable hang in the Bluetooth host thread; the stray indirect call is through an all-zero pointer whose target the attacker does not control, so the practical impact is denial of service.\n\nThe fix keeps the object allocated and marks it with a new BT_HFP_HF_FLAG_RELEASING flag, letting bt_hfp_hf_discover_cb() release it once the discovery completes instead of destroying it under the SDP client. Only builds with CONFIG_BT_CLASSIC and CONFIG_BT_HFP_HF enabled are affected.","summary":"When an HFP Hands-Free connection fails during SDP discovery, Zephyr's Bluetooth host zeroes an object that is still referenced by the SDP client's request list. A nearby remote device can trigger this by advertising an out-of-range RFCOMM channel, causing a host crash or hang.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bluetooth","embedded","hfp","runtime","zephyr"],"not_affected_if":["bluetooth-classic-disabled","hfp-hf-disabled"],"how_to_check":"- Check whether the build enables `CONFIG_BT_CLASSIC` and `CONFIG_BT_HFP_HF` in the Zephyr configuration\n- Check the Zephyr version in use against the fixed release named in the advisory (unknown in the sources)","fix":"- Update Zephyr to a release that includes the fix adding `BT_HFP_HF_FLAG_RELEASING` (exact version unknown in the sources)\n- Until updated, disable `CONFIG_BT_HFP_HF` if HFP Hands-Free is not needed","status":"open","published_at":"2026-10-26T17:17:30+00:00","first_seen_at":"2026-10-26T17:31:22+00:00","triaged_at":"2026-10-26T17:33:26+00:00","updated_at":"2026-10-26T17:33:26+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-26T17:33:26Z","model":"claude-haiku-5-5","output":{"fix":"- Update Zephyr to a release that includes the fix adding `BT_HFP_HF_FLAG_RELEASING` (exact version unknown in the sources)\n- Until updated, disable `CONFIG_BT_HFP_HF` if HFP Hands-Free is not needed","reach":"network","title":"Zephyr Bluetooth HFP: failed connect wipes object still linked in SDP list","impact":"low","summary":"When an HFP Hands-Free connection fails during SDP discovery, Zephyr's Bluetooth host zeroes an object that is still referenced by the SDP client's request list. A nearby remote device can trigger this by advertising an out-of-range RFCOMM channel, causing a host crash or hang.","category":"runtime","nicknames":[],"who_cares":["zephyr","embedded","bluetooth","hfp"],"confidence":0.7,"needs_auth":"no","worst_case":"Bluetooth host thread faults or hangs, causing denial of service","analyst_note":"Confirm the fixed Zephyr version and patched release from the NVD entry and the Zephyr advisory; sources give no fix version.","how_to_check":"- Check whether the build enables `CONFIG_BT_CLASSIC` and `CONFIG_BT_HFP_HF` in the Zephyr configuration\n- Check the Zephyr version in use against the fixed release named in the advisory (unknown in the sources)","needs_analyst":true,"not_affected_if":["bluetooth-classic-disabled","hfp-hf-disabled"],"who_is_affected":"Only Zephyr builds with both CONFIG_BT_CLASSIC and CONFIG_BT_HFP_HF enabled are affected, meaning devices acting as an HFP Hands-Free client that connect to remote Audio Gateways. The trigger is a nearby peer advertising an HFP AG SDP record with an RFCOMM channel outside 1-30, or controlling connection timing. Products without classic Bluetooth HFP Hands-Free support can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000791,"input_tokens":4222,"output_tokens":737,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-30':291C '-82388':15A,18A '0':154C '1':290C 'acl':337C,399C 'advertis':61B,280C 'affect':143C,532C 'ag':283C 'all-zero':462C 'alloc':81C,362C,486C 'along':180C 'alreadi':200C 'also':396C 'append':416C 'applic':314C 'attack':469C 'audio':255C 'block':121C 'bluetooth':2A,19B,37B,354C,452C 'branch':228C,309C 'bt':75C,110C,136C,214C,240C,261C,267C,293C,331C,493C,500C,523C,527C 'buf':363C 'build':520C 'call':114C,346C,377C,458C 'caller':118C 'caller-own':117C 'cancel':217C 'caus':69B 'cb':504C 'channel':68B,249C,288C 'check':273C,392C 'classic':524C 'clear':397C 'client':49B,125C,177C,361C,518C 'code':144C 'complet':510C 'config':522C,526C 'connect':5A,30B,78C,85C,139C,243C,270C,296C,321C,413C 'consid':404C 'continu':356C 'control':320C,472C 'could':209C 'crash':72B 'creat':94C 'creation':342C 'cve':13A,16A 'declar':219C 'denial':478C 'derefer':364C 'destroy':513C 'devic':56B,279C,303C 'disconnect':334C 'discov':112C,216C,503C 'discoveri':34B,99C,160C,208C,509C 'dlc':138C,295C 'document':237C 'drive':300C 'drop':339C 'einval':298C 'embed':20B,105C 'enabl':530C 'entir':147C 'exampl':324C 'fail':4A,31B,141C,227C 'fault':445C 'fix':482C 'flag':496C,498C 'free':29B,89C,405C 'func':185C,380C 'function':384C 'gateway':256C 'get':263C 'hand':28B,88C 'hands-fre':27B,87C 'hang':74B,449C 'hf':77C,93C,106C,153C,157C,193C,242C,269C,398C,495C,502C,529C 'hfp':3A,21B,26B,76C,86C,92C,241C,268C,282C,412C,494C,501C,528C 'host':38B,71B,355C,435C,453C 'impact':476C 'implement':225C 'include/zephyr/bluetooth/classic/sdp.h':221C 'incom':411C 'indirect':457C 'input':235C 'instead':213C,511C 'item':197C 'keep':483C 'leav':440C 'let':499C 'link':9A,115C,173C,421C 'list':12A,52B,128C,179C,422C,432C,437C 'local':302C 'make':292C 'mark':488C 'may':199C 'memset':151C 'misus':315C 'nearbi':54B 'neither':260C,386C 'never':439C 'new':152C,156C,492C 'node':169C,423C 'null':371C,383C,391C 'null-check':390C 'object':7A,41B,90C,103C,148C,341C,349C,485C 'out-of-rang':63B 'outsid':289C 'outstand':163C 'own':119C 'param':108C,265C,366C,379C 'paramet':120C 'pass':101C,246C 'path':376C 'peer':233C,319C 'peer-suppli':232C 'per':84C 'per-connect':83C 'pointer':189C,385C,465C 'pool':188C,367C,401C 'practic':475C 'proto':264C 'queu':202C 'rang':66B,272C 'range-check':271C 're':415C 're-append':414C 'reach':311C 'reachabl':230C 'read':250C 'receiv':375C 'record':259C,284C 'referenc':45B 'referenti':431C 'releas':497C,505C 'remot':55B,254C,278C,318C 'req':130C,426C 'request':51B,127C,183C 'result':442C 'retract':212C 'retri':408C 'return':297C 'rfcomm':67B,137C,248C,287C,294C,327C,332C,345C 'runtim':22B 'sdp':11A,33B,48B,98C,107C,111C,124C,176C,215C,258C,262C,360C,374C,517C 'self':430C 'self-referenti':429C 'servic':480C 'session':129C,328C,365C,378C,425C 'sizeof':155C 'slc':194C 'slot':402C 'snode':167C 'start':96C 'state':333C 'still':8A,44B,162C,172C,420C 'still-link':419C 'stray':456C 'subsequ':135C 'subsys/bluetooth/host/classic/hfp_hf.c':80C 'subsys/bluetooth/host/classic/sdp.c':132C 'suppli':234C 'sys':166C 'system':205C 'target':467C 'thread':454C 'time':322C 'trigger':58B 'turn':424C 'unrecover':448C 'use':238C,358C 'uuid':186C 'valu':275C 'void':150C 'walker':438C 'whose':466C 'wipe':6A,145C,306C,352C,395C 'without':312C 'work':195C,196C 'workqueu':206C 'zephyr':1A,23B,35B 'zero':39B,164C,191C,464C","nicknames":[],"mitigations":[],"who_affected":"Only Zephyr builds with both CONFIG_BT_CLASSIC and CONFIG_BT_HFP_HF enabled are affected, meaning devices acting as an HFP Hands-Free client that connect to remote Audio Gateways. The trigger is a nearby peer advertising an HFP AG SDP record with an RFCOMM channel outside 1-30, or controlling connection timing. Products without classic Bluetooth HFP Hands-Free support can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T17:17:30+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"vulnerabilities@zephyrproject.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-82388","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82388","severity":null,"published_at":"2026-10-26T17:17:30+00:00","modified_at":"2026-10-26T17:17:30+00:00","first_seen_at":"2026-10-26T17:31:22+00:00","fetched_at":"2026-10-26T17:31:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}