Bluetooth Hands-Free Profile Vulnerability in Zephyr RTOS

CVE-2026-82388

What is CVE-2026-82388?

This vulnerability occurs in the Bluetooth Hands-Free Profile implementation of Zephyr RTOS, specifically within the connection handling process. When initiating a connection through the bt_hfp_hf_connect() function, if an RFCOMM channel is specified incorrectly or the connection timing is managed by a remote peer, the system can enter an unsafe state where critical memory is cleared prematurely. This mismanagement can lead to a denial of service as the Bluetooth host continues to operate using invalid references, potentially causing system hangs or faults. The recent fix involves keeping the object allocated until discovery completes, preventing premature memory wipe and maintaining system stability.

References