Bluetooth Classic Audio Gateway Vulnerability in Zephyr Project

CVE-2026-82389

What is CVE-2026-82389?

In the Bluetooth Classic Hands-Free Profile Audio Gateway implementation, a flaw in the hfp_ag_create() function can lead to an improper cleanup situation where object memory is cleared while still linked in the SDP client request list. This oversight may result in system hangs or crashes when the Bluetooth stack attempts to process these corrupted requests. Notably, the failure to cancel in-flight SDP discovery coupled with a lack of validation on RFCOMM channel parameters exposes devices to potential abuse from nearby Bluetooth devices that exploit these weaknesses, potentially destabilizing Bluetooth connectivity.

References