{"id":"CVE-2026-92241","kind":"vulnerability","aliases":["CVE-2026-92241"],"related":[],"title":"Zephyr Bluetooth: paired AVRCP peer can hang the whole Bluetooth host","description":"The AVRCP browsing channel's L2CAP receive-buffer callback, browsing_avrcp_l2cap_alloc_buf() in subsys/bluetooth/host/classic/avrcp.c, allocated from the shared avctp_browsing_rx_pool with K_FOREVER. L2CAP invokes that callback from the Bluetooth RX work queue thread (bt_workq, \"BT RX WQ\"), both for the head buffer of a new SDU and — through l2cap_br_alloc_frag() and net_buf_append_bytes() — for every further fragment of a reassembled SDU. That same thread is the only context that ever releases these buffers, after bt_l2cap_br_recv_seg() delivers a completed SDU and calls net_buf_unref(), so a wait taken there can never be satisfied.\n\nThe pool holds CONFIG_BT_MAX_CONN + 1 buffers of CONFIG_BT_AVRCP_BROWSING_L2CAP_MTU bytes (two buffers of 339 bytes in the default configuration). A connected browsing peer can drain it because bt_l2cap_br_recv_seg() in subsys/bluetooth/host/classic/l2cap_br.c accepts the SDU length declared in an SAR_START segment without bounding it by br_chan->rx.mtu: a peer that announces a large SDU and then streams continuation segments forces one pool buffer per segment-worth of data. Once the pool is empty the next allocation blocks forever inside the callback.\n\nTriggering the flaw requires a build with CONFIG_BT_CLASSIC and the experimental CONFIG_BT_AVRCP_BROWSING option, an application that registers AVRCP callbacks, and a BR/EDR peer that has established the AVRCP control channel and then the browsing channel, which requires an encrypted (paired) link. No malformed packet is needed — a few hundred bytes of ordinary segmented L2CAP traffic suffice.\n\nThe consequence is a permanent hang of the whole Bluetooth host, not just of AVRCP: the blocked thread drains bt_dev.rx_queue for all HCI ACL data and low-priority events and also runs the host's internal work items, so all connections stop being serviced and the state is unrecoverable without a reboot. There is no memory-corruption or information-disclosure component. The fix allocates with K_NO_WAIT, so an empty pool now yields a local-busy indication or a channel disconnect that the application can recover from.","summary":"A paired Bluetooth Classic peer that opens the AVRCP browsing channel and streams segmented L2CAP data can exhaust a receive-buffer pool and block the Bluetooth RX thread forever. The result is a permanent hang of all Bluetooth host processing on the device until reboot, with no code execution or data exposure reported.","severity":"medium","cvss":5.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["avrcp","bluetooth","embedded","runtime","zephyr"],"not_affected_if":["ble-only","default-config","no-avrcp-browsing","unpaired-peers"],"how_to_check":"- Check whether the build sets `CONFIG_BT_CLASSIC` and the experimental `CONFIG_BT_AVRCP_BROWSING` option\n- Check whether the application registers AVRCP callbacks\n- Check the Zephyr version in use against the fix, since the sources give no fixed version","fix":null,"status":"open","published_at":"2026-11-13T14:18:01+00:00","first_seen_at":"2026-11-13T15:19:50+00:00","triaged_at":"2026-11-13T15:21:31+00:00","updated_at":"2026-11-13T15:21:31+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-13T15:21:31Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Zephyr Bluetooth: paired AVRCP peer can hang the whole Bluetooth host","impact":"high","summary":"A paired Bluetooth Classic peer that opens the AVRCP browsing channel and streams segmented L2CAP data can exhaust a receive-buffer pool and block the Bluetooth RX thread forever. The result is a permanent hang of all Bluetooth host processing on the device until reboot, with no code execution or data exposure reported.","audience":"developers","category":"runtime","nicknames":[],"who_cares":["zephyr","bluetooth","embedded","avrcp"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Bluetooth host hangs permanently until the device is rebooted","analyst_note":"Confirm the fixed Zephyr version from the linked patch and advisory at github.com; the sources given do not name it.","how_to_check":"- Check whether the build sets `CONFIG_BT_CLASSIC` and the experimental `CONFIG_BT_AVRCP_BROWSING` option\n- Check whether the application registers AVRCP callbacks\n- Check the Zephyr version in use against the fix, since the sources give no fixed version","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["default-config","no-avrcp-browsing","ble-only","unpaired-peers"],"who_is_affected":"Only builds that enable both `CONFIG_BT_CLASSIC` and the experimental `CONFIG_BT_AVRCP_BROWSING` option and register AVRCP callbacks are exposed. The attacker must be a BR/EDR peer already paired with the device, since the browsing channel needs an encrypted link. Devices without these options can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000868,"input_tokens":5324,"output_tokens":672,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-92241':14A,17A '1':192C '339':205C 'accept':226C 'acl':363C 'alloc':90C,94C,134C,272C,406C 'also':371C 'announc':246C 'append':139C 'applic':297C,428C 'avctp':98C 'avrcp':4A,18B,31B,78C,88C,197C,293C,300C,310C,353C 'block':47B,273C,355C 'bluetooth':2A,10A,19B,25B,49B,61B,111C,348C 'bound':237C 'br':133C,164C,221C,240C 'br/edr':304C 'brows':32B,79C,87C,99C,198C,213C,294C,316C 'bt':116C,118C,162C,189C,196C,219C,286C,292C 'bt_dev.rx':358C 'buf':91C,138C,174C 'buffer':44B,85C,125C,160C,193C,203C,258C 'build':283C 'busi':420C 'byte':140C,201C,206C,332C 'call':172C 'callback':86C,108C,277C,301C 'chan':241C 'channel':33B,80C,312C,317C,424C 'classic':26B,287C 'code':71B 'complet':169C 'compon':403C 'config':188C,195C,285C,291C 'configur':210C 'conn':191C 'connect':212C,381C 'consequ':340C 'context':155C 'continu':253C 'control':311C 'corrupt':398C 'cve':12A,15A 'data':38B,74B,264C,364C 'declar':230C 'default':209C 'deliv':167C 'devic':66B 'disclosur':402C 'disconnect':425C 'drain':216C,357C 'embed':20B 'empti':269C,413C 'encrypt':321C 'establish':308C 'event':369C 'ever':157C 'everi':142C 'execut':72B 'exhaust':40B 'experiment':290C 'exposur':75B 'fix':405C 'flaw':280C 'forc':255C 'forev':52B,104C,274C 'frag':135C 'fragment':144C 'hang':7A,58B,344C 'hci':362C 'head':124C 'hold':187C 'host':11A,62B,349C,374C 'hundr':331C 'indic':421C 'inform':401C 'information-disclosur':400C 'insid':275C 'intern':376C 'invok':106C 'item':378C 'k':103C,408C 'l2cap':37B,82C,89C,105C,132C,163C,199C,220C,336C 'larg':248C 'length':229C 'link':323C 'local':419C 'local-busi':418C 'low':367C 'low-prior':366C 'malform':325C 'max':190C 'memori':397C 'memory-corrupt':396C 'mtu':200C 'need':328C 'net':137C,173C 'never':182C 'new':128C 'next':271C 'one':256C 'open':29B 'option':295C 'ordinari':334C 'packet':326C 'pair':3A,24B,322C 'peer':5A,27B,214C,244C,305C 'per':259C 'perman':57B,343C 'pool':45B,101C,186C,257C,267C,414C 'prioriti':368C 'process':63B 'queue':114C,359C 'reassembl':147C 'reboot':68B,392C 'receiv':43B,84C 'receive-buff':42B,83C 'recov':430C 'recv':165C,222C 'regist':299C 'releas':158C 'report':76B 'requir':281C,319C 'result':54B 'run':372C 'runtim':21B 'rx':50B,100C,112C,119C 'rx.mtu':242C 'sar':233C 'satisfi':184C 'sdu':129C,148C,170C,228C,249C 'seg':166C,223C 'segment':36B,235C,254C,261C,335C 'segment-worth':260C 'servic':384C 'share':97C 'start':234C 'state':387C 'stop':382C 'stream':35B,252C 'subsys/bluetooth/host/classic/avrcp.c':93C 'subsys/bluetooth/host/classic/l2cap_br.c':225C 'suffic':338C 'taken':179C 'thread':51B,115C,151C,356C 'traffic':337C 'trigger':278C 'two':202C 'unrecover':389C 'unref':175C 'wait':178C,410C 'whole':9A,347C 'without':236C,390C 'work':113C,377C 'workq':117C 'worth':262C 'wq':120C 'yield':416C 'zephyr':1A,22B","nicknames":[],"mitigations":[],"who_affected":"Only builds that enable both `CONFIG_BT_CLASSIC` and the experimental `CONFIG_BT_AVRCP_BROWSING` option and register AVRCP callbacks are exposed. The attacker must be a BR/EDR peer already paired with the device, since the browsing channel needs an encrypted link. Devices without these options can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["avrcp","bluetooth","embedded","medium","runtime","zephyr"],"campaign_type":null,"search_a":"'-2026':13A,16A '-92241':14A,17A 'avrcp':4A 'bluetooth':2A,10A 'cve':12A,15A 'hang':7A 'host':11A 'pair':3A 'peer':5A 'whole':9A 'zephyr':1A","search_b":"'avrcp':18B,31B 'block':47B 'bluetooth':19B,25B,49B,61B 'brows':32B 'buffer':44B 'channel':33B 'classic':26B 'code':71B 'data':38B,74B 'devic':66B 'embed':20B 'execut':72B 'exhaust':40B 'exposur':75B 'forev':52B 'hang':58B 'host':62B 'l2cap':37B 'open':29B 'pair':24B 'peer':27B 'perman':57B 'pool':45B 'process':63B 'reboot':68B 'receiv':43B 'receive-buff':42B 'report':76B 'result':54B 'runtim':21B 'rx':50B 'segment':36B 'stream':35B 'thread':51B 'zephyr':22B","search_c":"'1':192C '339':205C 'accept':226C 'acl':363C 'alloc':90C,94C,134C,272C,406C 'also':371C 'announc':246C 'append':139C 'applic':297C,428C 'avctp':98C 'avrcp':78C,88C,197C,293C,300C,310C,353C 'block':273C,355C 'bluetooth':111C,348C 'bound':237C 'br':133C,164C,221C,240C 'br/edr':304C 'brows':79C,87C,99C,198C,213C,294C,316C 'bt':116C,118C,162C,189C,196C,219C,286C,292C 'bt_dev.rx':358C 'buf':91C,138C,174C 'buffer':85C,125C,160C,193C,203C,258C 'build':283C 'busi':420C 'byte':140C,201C,206C,332C 'call':172C 'callback':86C,108C,277C,301C 'chan':241C 'channel':80C,312C,317C,424C 'classic':287C 'complet':169C 'compon':403C 'config':188C,195C,285C,291C 'configur':210C 'conn':191C 'connect':212C,381C 'consequ':340C 'context':155C 'continu':253C 'control':311C 'corrupt':398C 'data':264C,364C 'declar':230C 'default':209C 'deliv':167C 'disclosur':402C 'disconnect':425C 'drain':216C,357C 'empti':269C,413C 'encrypt':321C 'establish':308C 'event':369C 'ever':157C 'everi':142C 'experiment':290C 'fix':405C 'flaw':280C 'forc':255C 'forev':104C,274C 'frag':135C 'fragment':144C 'hang':344C 'hci':362C 'head':124C 'hold':187C 'host':349C,374C 'hundr':331C 'indic':421C 'inform':401C 'information-disclosur':400C 'insid':275C 'intern':376C 'invok':106C 'item':378C 'k':103C,408C 'l2cap':82C,89C,105C,132C,163C,199C,220C,336C 'larg':248C 'length':229C 'link':323C 'local':419C 'local-busi':418C 'low':367C 'low-prior':366C 'malform':325C 'max':190C 'memori':397C 'memory-corrupt':396C 'mtu':200C 'need':328C 'net':137C,173C 'never':182C 'new':128C 'next':271C 'one':256C 'option':295C 'ordinari':334C 'packet':326C 'pair':322C 'peer':214C,244C,305C 'per':259C 'perman':343C 'pool':101C,186C,257C,267C,414C 'prioriti':368C 'queue':114C,359C 'reassembl':147C 'reboot':392C 'receiv':84C 'receive-buff':83C 'recov':430C 'recv':165C,222C 'regist':299C 'releas':158C 'requir':281C,319C 'run':372C 'rx':100C,112C,119C 'rx.mtu':242C 'sar':233C 'satisfi':184C 'sdu':129C,148C,170C,228C,249C 'seg':166C,223C 'segment':235C,254C,261C,335C 'segment-worth':260C 'servic':384C 'share':97C 'start':234C 'state':387C 'stop':382C 'stream':252C 'subsys/bluetooth/host/classic/avrcp.c':93C 'subsys/bluetooth/host/classic/l2cap_br.c':225C 'suffic':338C 'taken':179C 'thread':115C,151C,356C 'traffic':337C 'trigger':278C 'two':202C 'unrecover':389C 'unref':175C 'wait':178C,410C 'whole':347C 'without':236C,390C 'work':113C,377C 'workq':117C 'worth':262C 'wq':120C 'yield':416C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T14:03:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvss_by":"vulnerabilities@zephyrproject.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-92241","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92241","severity":null,"published_at":"2026-11-13T14:18:01+00:00","modified_at":"2026-11-13T14:18:03+00:00","first_seen_at":"2026-11-13T15:19:50+00:00","fetched_at":"2026-11-13T15:19:50+00:00","note":null}],"documents":[{"id":147087,"url":"https://github.com/zephyrproject-rtos/zephyr/commit/c8c2438f05165397347613b44dd8e9eaa1243139","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":147088,"url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-8vpg-4235-9qjj","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-13T14:03:11+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}