CVE-2026-82389 (GCVE-0-2026-82389)
Vulnerability from cvelistv5
Published
2026-10-26 16:08
Modified
2026-10-26 17:37
Severity ?
6.5 (Medium) - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE
Summary
In the Bluetooth Classic Hands-Free Profile Audio Gateway role, hfp_ag_create() in subsys/bluetooth/host/classic/hfp_ag.c starts an SDP discovery toward the peer, which links the embedded ag->sdp_param._node into the SDP client's pending request list in subsys/bluetooth/host/classic/sdp.c. If the subsequent bt_rfcomm_dlc_connect() call fails, bt_hfp_ag_connect() cleaned up by memset()-ing the entire AG object while that node was still linked, and while ag->slc_work could still be queued on the system work queue. An in-flight SDP discovery cannot be cancelled — bt_sdp_discover_cancel() is declared in the public header but has no implementation — so the request stays in the list with its func, pool and uuid pointers zeroed. The RFCOMM channel passed to bt_hfp_ag_connect() is taken from the peer's own SDP Hands-Free service record in the normal AG flow (bt_sdp_get_proto_param() performs no range validation, and samples/bluetooth/classic/handsfree_ag feeds the value straight through), so a remote BR/EDR device in radio range that advertises an RFCOMM channel outside the valid range 0x01..0x1e deterministically forces bt_rfcomm_dlc_connect() to fail and reach the wipe. Reading the peer's SDP record requires no pairing, and the peer can also trigger the failure by dropping the ACL or racing an RFCOMM DLC on the same DLCI at the right moment. When the SDP client next advances its request list, sdp_client_discover() dereferences the zeroed parameters — net_buf_alloc(param->pool, …) with a NULL pool and param->uuid->type — and the result-notification paths call through the NULL params->func. Zeroing a linked node also truncates the request list behind a stale tail pointer, and re-arming the freed AG slot re-appends the same node and can produce a self-looping list that hangs the Bluetooth RX thread. The impact is a crash or hang of the Bluetooth stack; the written value is a constant zero at a fixed static address, so no attacker-controlled write is available. Only builds with CONFIG_BT_CLASSIC and CONFIG_BT_HFP_AG that use the Audio Gateway role are affected.
References
Impacted products
Vendor Product Version
zephyrproject zephyr Version: 4.4.0   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-82389",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-26T16:49:22.774483Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-26T17:37:10.685Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/zephyrproject-rtos/zephyr",
          "defaultStatus": "unaffected",
          "packageName": "zephyr",
          "product": "zephyr",
          "programFiles": [
            "subsys/bluetooth/host/classic/hfp_ag.c",
            "subsys/bluetooth/host/classic/hfp_ag_internal.h"
          ],
          "programRoutines": [
            {
              "name": "bt_hfp_ag_connect"
            },
            {
              "name": "bt_hfp_ag_discover_cb"
            }
          ],
          "vendor": "zephyrproject",
          "versions": [
            {
              "lessThan": "4.5.0",
              "status": "affected",
              "version": "4.4.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Bluetooth Classic Hands-Free Profile Audio Gateway role, hfp_ag_create() in subsys/bluetooth/host/classic/hfp_ag.c starts an SDP discovery toward the peer, which links the embedded ag-\u003esdp_param._node into the SDP client\u0027s pending request list in subsys/bluetooth/host/classic/sdp.c. If the subsequent bt_rfcomm_dlc_connect() call fails, bt_hfp_ag_connect() cleaned up by memset()-ing the entire AG object while that node was still linked, and while ag-\u003eslc_work could still be queued on the system work queue. An in-flight SDP discovery cannot be cancelled \u2014 bt_sdp_discover_cancel() is declared in the public header but has no implementation \u2014 so the request stays in the list with its func, pool and uuid pointers zeroed.\n\nThe RFCOMM channel passed to bt_hfp_ag_connect() is taken from the peer\u0027s own SDP Hands-Free service record in the normal AG flow (bt_sdp_get_proto_param() performs no range validation, and samples/bluetooth/classic/handsfree_ag feeds the value straight through), so a remote BR/EDR device in radio range that advertises an RFCOMM channel outside the valid range 0x01..0x1e deterministically forces bt_rfcomm_dlc_connect() to fail and reach the wipe. Reading the peer\u0027s SDP record requires no pairing, and the peer can also trigger the failure by dropping the ACL or racing an RFCOMM DLC on the same DLCI at the right moment.\n\nWhen the SDP client next advances its request list, sdp_client_discover() dereferences the zeroed parameters \u2014 net_buf_alloc(param-\u003epool, \u2026) with a NULL pool and param-\u003euuid-\u003etype \u2014 and the result-notification paths call through the NULL params-\u003efunc. Zeroing a linked node also truncates the request list behind a stale tail pointer, and re-arming the freed AG slot re-appends the same node and can produce a self-looping list that hangs the Bluetooth RX thread. The impact is a crash or hang of the Bluetooth stack; the written value is a constant zero at a fixed static address, so no attacker-controlled write is available.\n\nOnly builds with CONFIG_BT_CLASSIC and CONFIG_BT_HFP_AG that use the Audio Gateway role are affected."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "memory-safety",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-26T16:08:53.604Z",
        "orgId": "e2e69745-5e70-4e92-8431-deb5529a81ad",
        "shortName": "zephyr"
      },
      "references": [
        {
          "name": "Fix commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/zephyrproject-rtos/zephyr/commit/18a3243b21ef6298988a3034dbda2704a7ad73a4"
        },
        {
          "name": "GHSA-rrqj-542q-26jm",
          "url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-rrqj-542q-26jm"
        }
      ],
      "title": "Bluetooth Classic HFP AG wipes an object still linked in the SDP request list on connect failure, causing a NULL dereference",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e2e69745-5e70-4e92-8431-deb5529a81ad",
    "assignerShortName": "zephyr",
    "cveId": "CVE-2026-82389",
    "datePublished": "2026-10-26T16:08:53.604Z",
    "dateReserved": "2026-08-28T21:11:42.388Z",
    "dateUpdated": "2026-10-26T17:37:10.685Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-82389\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-26T16:49:22.774483Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-26T17:35:23.400Z\"}}], \"cna\": {\"title\": \"Bluetooth Classic HFP AG wipes an object still linked in the SDP request list on connect failure, causing a NULL dereference\", \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 6.5, \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\"}}], \"affected\": [{\"vendor\": \"zephyrproject\", \"product\": \"zephyr\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.4.0\", \"lessThan\": \"4.5.0\", \"versionType\": \"semver\"}], \"packageName\": \"zephyr\", \"programFiles\": [\"subsys/bluetooth/host/classic/hfp_ag.c\", \"subsys/bluetooth/host/classic/hfp_ag_internal.h\"], \"collectionURL\": \"https://github.com/zephyrproject-rtos/zephyr\", \"defaultStatus\": \"unaffected\", \"programRoutines\": [{\"name\": \"bt_hfp_ag_connect\"}, {\"name\": \"bt_hfp_ag_discover_cb\"}]}], \"references\": [{\"url\": \"https://github.com/zephyrproject-rtos/zephyr/commit/18a3243b21ef6298988a3034dbda2704a7ad73a4\", \"name\": \"Fix commit\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-rrqj-542q-26jm\", \"name\": \"GHSA-rrqj-542q-26jm\"}], \"x_generator\": {\"engine\": \"cvelib 1.8.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Bluetooth Classic Hands-Free Profile Audio Gateway role, hfp_ag_create() in subsys/bluetooth/host/classic/hfp_ag.c starts an SDP discovery toward the peer, which links the embedded ag-\u003esdp_param._node into the SDP client\u0027s pending request list in subsys/bluetooth/host/classic/sdp.c. If the subsequent bt_rfcomm_dlc_connect() call fails, bt_hfp_ag_connect() cleaned up by memset()-ing the entire AG object while that node was still linked, and while ag-\u003eslc_work could still be queued on the system work queue. An in-flight SDP discovery cannot be cancelled \\u2014 bt_sdp_discover_cancel() is declared in the public header but has no implementation \\u2014 so the request stays in the list with its func, pool and uuid pointers zeroed.\\n\\nThe RFCOMM channel passed to bt_hfp_ag_connect() is taken from the peer\u0027s own SDP Hands-Free service record in the normal AG flow (bt_sdp_get_proto_param() performs no range validation, and samples/bluetooth/classic/handsfree_ag feeds the value straight through), so a remote BR/EDR device in radio range that advertises an RFCOMM channel outside the valid range 0x01..0x1e deterministically forces bt_rfcomm_dlc_connect() to fail and reach the wipe. Reading the peer\u0027s SDP record requires no pairing, and the peer can also trigger the failure by dropping the ACL or racing an RFCOMM DLC on the same DLCI at the right moment.\\n\\nWhen the SDP client next advances its request list, sdp_client_discover() dereferences the zeroed parameters \\u2014 net_buf_alloc(param-\u003epool, \\u2026) with a NULL pool and param-\u003euuid-\u003etype \\u2014 and the result-notification paths call through the NULL params-\u003efunc. Zeroing a linked node also truncates the request list behind a stale tail pointer, and re-arming the freed AG slot re-appends the same node and can produce a self-looping list that hangs the Bluetooth RX thread. The impact is a crash or hang of the Bluetooth stack; the written value is a constant zero at a fixed static address, so no attacker-controlled write is available.\\n\\nOnly builds with CONFIG_BT_CLASSIC and CONFIG_BT_HFP_AG that use the Audio Gateway role are affected.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-476\", \"description\": \"memory-safety\"}]}], \"providerMetadata\": {\"orgId\": \"e2e69745-5e70-4e92-8431-deb5529a81ad\", \"shortName\": \"zephyr\", \"dateUpdated\": \"2026-10-26T16:08:53.604Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-82389\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-26T17:37:10.685Z\", \"dateReserved\": \"2026-08-28T21:11:42.388Z\", \"assignerOrgId\": \"e2e69745-5e70-4e92-8431-deb5529a81ad\", \"datePublished\": \"2026-10-26T16:08:53.604Z\", \"assignerShortName\": \"zephyr\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.