Bluetooth Classic Hands-Free Profile Vulnerability in Zephyr RTOS

CVE-2026-77684

What is CVE-2026-77684?

A malfunction in the Bluetooth Classic Hands-Free Profile within the Zephyr RTOS can lead to permanent loss of command buffers when the RFCOMM Data Link Connection (DLC) is disrupted. Specifically, queued AT command buffers on the hf->tx_pending list remain unreleased, resulting in exhaustion of the buffer pool. This issue also causes potential deadlock scenarios, where continued attempts to send commands can stall the Bluetooth RX thread, halting event processing. Exploitation requires an active Hands-Free Profile session and specific configurations within the Zephyr build.

References