{"id":"CVE-2026-85033","kind":"vulnerability","aliases":["CVE-2026-85033"],"related":[],"title":"Zephyr Bluetooth AVRCP: link drop mid-response stalls later responses and leaks buffers","description":"The AVRCP Target role in subsys/bluetooth/host/classic/avrcp.c keeps its vendor-dependent response transmit state in a per-connection object selected by connection index (get_avrcp_tg()), with the per-transfer context (tid, sent_len, and the BT_AVRCP_TG_FLAG_TX_ONGOING flag) stored in the user_data of the queued response net_buf. The AVCTP teardown handler avrcp_disconnected() did not cancel tg->vd_rsp_tx_work and did not release the buffers still queued on tg->vd_rsp_tx_pending, so a link drop in the middle of a fragmented response left the buffer on the list with TX_ONGOING still set.\n\nA remote AVRCP Controller can trigger this deterministically: it issues a vendor-dependent command whose response exceeds one AVRCP fragment (for example GetElementAttributes or GetCapabilities), lets bt_avrcp_tg_vendor_tx_work() emit the START fragment, and then drops the ACL link instead of sending REQUEST_CONTINUING_RESPONSE. The AVCTP control channel requires an encrypted BR/EDR link (BT_SECURITY_L2), so the attacker must be a paired peer within radio range; no user interaction is needed.\n\nBecause the Target objects are static and reused, the next connection landing on the same connection index finds the stale buffer at the head of vd_rsp_tx_pending. Every run of the TX work sees TX_ONGOING and returns immediately, so all further vendor-dependent responses queue behind the stale head and are never sent — a persistent loss of AVRCP Target function that no timeout clears and only a reboot recovers. Each cycle also leaks one response buffer from a shallow application pool, and a new peer that sends REQUEST_CONTINUING_RESPONSE clears the stale TX_ONGOING via bt_avrcp_tg_process_continuing_cmd(), causing the un-sent remainder of the previous peer's response to be transmitted to it.\n\nThe fix cancels tg->vd_rsp_tx_work and unrefs every buffer on tg->vd_rsp_tx_pending in avrcp_disconnected(); since the TX context lives in the buffer user_data, releasing the buffers also resets the TX state machine. There is no memory corruption: the pre-fix buffer is leaked with a live reference, so no use-after-free arises.","summary":"Zephyr's Bluetooth AVRCP Target code does not release a half-sent vendor-dependent response when the link drops, so the stale state persists on the reused connection slot. A paired nearby peer can stop further AVRCP vendor responses from being sent and leak a buffer each cycle, and a later peer can receive the remainder of the earlier peer's response.","severity":"medium","cvss":4.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["avrcp","bluetooth","embedded","runtime","zephyr"],"not_affected_if":["avrcp-target-disabled","no-bluetooth-classic","unpaired-only"],"how_to_check":"- Check whether the device firmware is built on Zephyr with Bluetooth Classic AVRCP Target enabled (`subsys/bluetooth/host/classic/avrcp.c` present in the build).\n- Compare the Zephyr version against the fixed release in the advisory (unknown from these sources).","fix":null,"status":"open","published_at":"2026-11-03T14:17:38+00:00","first_seen_at":"2026-11-03T14:21:08+00:00","triaged_at":"2026-11-03T14:22:06+00:00","updated_at":"2026-11-03T14:22:06+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-03T14:22:06Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Zephyr Bluetooth AVRCP: link drop mid-response stalls later responses and leaks buffers","impact":"low","summary":"Zephyr's Bluetooth AVRCP Target code does not release a half-sent vendor-dependent response when the link drops, so the stale state persists on the reused connection slot. A paired nearby peer can stop further AVRCP vendor responses from being sent and leak a buffer each cycle, and a later peer can receive the remainder of the earlier peer's response.","audience":"developers","category":"runtime","nicknames":[],"who_cares":["zephyr","bluetooth","avrcp","embedded"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"Persistent loss of AVRCP Target function until reboot; leaked buffers; possible response data sent to another peer","analyst_note":"Confirm the fixed Zephyr version and the affected release range from the linked patch and vendor advisory (github.com).","how_to_check":"- Check whether the device firmware is built on Zephyr with Bluetooth Classic AVRCP Target enabled (`subsys/bluetooth/host/classic/avrcp.c` present in the build).\n- Compare the Zephyr version against the fixed release in the advisory (unknown from these sources).","plain_action":"","needs_analyst":true,"not_affected_if":["avrcp-target-disabled","no-bluetooth-classic","unpaired-only"],"who_is_affected":"Only devices running Zephyr firmware with Bluetooth Classic AVRCP Target role enabled are exposed. The attacker must already be a paired peer within radio range, since AVCTP requires an encrypted BR/EDR link, and no user interaction is needed. Teams using Zephyr in embedded products should check whether AVRCP Target is compiled in.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000829,"input_tokens":4877,"output_tokens":683,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-85033':17A,20A 'acl':237C 'also':348C,430C 'applic':356C 'aris':458C 'attack':259C 'avctp':147C,246C 'avrcp':3A,21B,29B,64B,91C,115C,129C,150C,198C,215C,224C,334C,374C,415C 'behind':322C 'bluetooth':2A,22B,28B 'br/edr':252C 'bt':128C,223C,254C,373C 'buf':145C 'buffer':14A,73B,165C,187C,293C,352C,407C,424C,429C,445C 'cancel':154C,398C 'caus':379C 'channel':248C 'clear':340C,367C 'cmd':378C 'code':31B 'command':210C 'connect':55B,108C,112C,283C,288C 'context':122C,420C 'continu':243C,365C,377C 'control':199C,247C 'corrupt':440C 'cve':15A,18A 'cycl':75B,347C 'data':139C,426C 'depend':41B,100C,209C,319C 'determinist':203C 'disconnect':151C,416C 'drop':5A,46B,177C,235C 'earlier':86B 'embed':23B 'emit':229C 'encrypt':251C 'everi':302C,406C 'exampl':218C 'exceed':213C 'find':290C 'fix':397C,444C 'flag':131C,134C 'fragment':183C,216C,232C 'free':457C 'function':336C 'get':114C 'getcap':221C 'getelementattribut':219C 'half':37B 'half-sent':36B 'handler':149C 'head':296C,325C 'immedi':313C 'index':113C,289C 'instead':239C 'interact':270C 'issu':205C 'keep':96C 'l2':256C 'land':284C 'later':10A,78B 'leak':13A,71B,349C,447C 'left':185C 'len':125C 'let':222C 'link':4A,45B,176C,238C,253C 'list':190C 'live':421C,450C 'loss':332C 'machin':435C 'memori':439C 'mid':7A 'mid-respons':6A 'middl':180C 'must':260C 'nearbi':59B 'need':272C 'net':144C 'never':328C 'new':360C 'next':282C 'object':109C,276C 'one':214C,350C 'ongo':133C,193C,310C,371C 'pair':58B,263C 'peer':60B,79B,87B,264C,361C,388C 'pend':173C,301C,413C 'per':107C,120C 'per-connect':106C 'per-transf':119C 'persist':51B,331C 'pool':357C 'pre':443C 'pre-fix':442C 'previous':387C 'process':376C 'queu':142C,167C 'queue':321C 'radio':266C 'rang':267C 'reboot':344C 'receiv':81B 'recov':345C 'refer':451C 'releas':34B,163C,427C 'remaind':83B,384C 'remot':197C 'request':242C,364C 'requir':249C 'reset':431C 'respons':8A,11A,42B,66B,89B,101C,143C,184C,212C,244C,320C,351C,366C,390C 'return':312C 'reus':54B,280C 'role':93C 'rsp':157C,171C,299C,401C,411C 'run':303C 'runtim':24B 'secur':255C 'see':308C 'select':110C 'send':241C,363C 'sent':38B,69B,124C,329C,383C 'set':195C 'shallow':355C 'sinc':417C 'slot':56B 'stale':49B,292C,324C,369C 'stall':9A 'start':231C 'state':50B,103C,434C 'static':278C 'still':166C,194C 'stop':62B 'store':135C 'subsys/bluetooth/host/classic/avrcp.c':95C 'target':30B,92C,275C,335C 'teardown':148C 'tg':116C,130C,155C,169C,225C,375C,399C,409C 'tid':123C 'timeout':339C 'transfer':121C 'transmit':102C,393C 'trigger':201C 'tx':132C,158C,172C,192C,227C,300C,306C,309C,370C,402C,412C,419C,433C 'un':382C 'un-sent':381C 'unref':405C 'use':455C 'use-after-fre':454C 'user':138C,269C,425C 'vd':156C,170C,298C,400C,410C 'vendor':40B,65B,99C,208C,226C,318C 'vendor-depend':39B,98C,207C,317C 'via':372C 'whose':211C 'within':265C 'work':159C,228C,307C,403C 'zephyr':1A,25B,26B","nicknames":[],"mitigations":[],"who_affected":"Only devices running Zephyr firmware with Bluetooth Classic AVRCP Target role enabled are exposed. The attacker must already be a paired peer within radio range, since AVCTP requires an encrypted BR/EDR link, and no user interaction is needed. Teams using Zephyr in embedded products should check whether AVRCP Target is compiled in.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["avrcp","bluetooth","embedded","medium","runtime","zephyr"],"first_public_at":"2026-11-02T21:42:31+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","cvss_by":"vulnerabilities@zephyrproject.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-85033","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85033","severity":null,"published_at":"2026-11-03T14:17:38+00:00","modified_at":"2026-11-03T14:17:39+00:00","first_seen_at":"2026-11-03T14:21:08+00:00","fetched_at":"2026-11-03T14:21:08+00:00","note":null}],"documents":[{"id":58018,"url":"https://github.com/zephyrproject-rtos/zephyr/commit/47728746bb52863607f06072c13a0a524ad6b654","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":58019,"url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-2fqc-xhj4-qvp7","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-02T21:42:31+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}