DoS Vulnerability in Bluetooth Classic HFP Audio Gateway Implementation by Zephyr Project

CVE-2026-19940

What is CVE-2026-19940?

The Bluetooth Classic Hands-Free Profile Audio Gateway in Zephyr Project contains a vulnerability that can lead to system denial of service. This occurs due to improper handling of connection teardown and re-establishment, which causes corruption in the kernel's timeout list. Specifically, the issue arises when an ongoing call's timeout is not properly managed after the connection is terminated. When a new connection is made using the same pool slot, it can lead to attempts to dereference null pointers, resulting in a system fault or hang. This vulnerability primarily affects builds with CONFIG_BT_HFP_AG enabled and requires specific application implementations, potentially allowing remote attackers to disrupt system functionality from Bluetooth radio range.

References