Description
The Bluetooth Classic Hands-Free Profile HF role in subsys/bluetooth/host/classic/hfp_hf.c does not release the AT command buffers that are still queued on hf->tx_pending when the RFCOMM DLC goes down. hfp_hf_disconnected() only cancelled the work items and cleared hf->acl, and no other code path ever dequeues those buffers, so each one is permanently lost from the fixed hf_pool (CONFIG_BT_MAX_CONN + 1 buffers, i.e. two in the default configuration). The same function also left BT_HFP_HF_FLAG_CONNECTED set, and hfp_hf_create() wiped the object with memset() as soon as hf->acl was NULL, without checking whether hf->work, hf->slc_work or hf->deferred_work was still pending or running.

The remote Audio Gateway peer controls the trigger end to end and needs no application involvement: an unsolicited +BCS: 1 response makes bcs_handle() call bt_hfp_hf_select_codec() and queue an AT+BCS buffer, which cannot be transmitted while BT_HFP_HF_FLAG_RX_ONGOING is set, and an immediately following RFCOMM DISC strands that buffer. Repeating the connect / +BCS / disconnect cycle a couple of times empties hf_pool for good.

With the pool exhausted, HFP command sending fails permanently, and because hfp_hf_send_cmd() allocates with K_FOREVER (bt_rfcomm_create_pdu() → bt_conn_create_pdu()) from the Bluetooth RX context — where that timeout is not downgraded to K_NO_WAIT — one further +BCS from the peer parks the Bluetooth RX thread inside net_buf_alloc() with no possible waker, halting all HCI event processing until the device is rebooted. Separately, reusing the HF slot while a work handler was still queued or running allowed memset() to wipe live k_work items out from under the system workqueue, corrupting shared kernel workqueue state. Exploitation requires an established HFP session (for SSP devices L2CAP enforces authentication before the RFCOMM channel is reachable) and a build with CONFIG_BT_HFP_HF enabled.
Published: 2026-10-19
Score: 5.7 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Immediate Patch
AI Analysis

Impact

The Bluetooth Classic Hands‑Free Profile HF role in Zephyr’s Bluetooth stack fails to release AT command buffers that remain queued when the RFCOMM link disconnects. This results in a permanent loss of the fixed buffer pool used by the HFP hand‑free module. Subsequent command transmissions fail, and the loss of buffers can stall the Bluetooth RX thread, effectively locking the device’s HCI event processing until a reboot. Additionally, the buggy deallocation path can corrupt kernel workqueue state if a work handler is still pending, potentially leading to further instability. The weakness is a classic resource leak labeled CWE‑401.

Affected Systems

Zephyr RTOS systems configured with the Bluetooth Classic Hands‑Free Profile (CONFIG_BT_HFP_HF enabled). The specific affected versions are not enumerated in the advisory, but the issue exists in any build that includes the buggy source before the commit identified in the linked GitHub change.

Risk and Exploitability

The vulnerability carries a CVSS score of 5.7, indicating medium severity. The exploit probability (EPSS) was not provided, and the flaw is not listed in the CISA KEV catalog, suggesting no known public exploits at the time of the advisory. An attacker needs to establish a legitimate HFP session, which requires authentication via L2CAP, and then repeatedly connect, send an unsolicited +BCS command, and disconnect to drain the buffer pool. Once the pool is exhausted, the device suffers a permanent denial of service and kernel workqueue corruption until reboot. This attack vector relies on remote Bluetooth communication rather than local system access.

Generated by OpenCVE AI on October 20, 2026 at 11:34 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Zephyr RTOS to a version that includes the fix implemented in commit 59c947c71f3d9ab4cf10fd28846e6ca4a3d53819.
  • If the Hands‑Free Profile is not required on the device, disable the CONFIG_BT_HFP_HF configuration option.
  • Monitor for frequent RFCOMM disconnects or bursty HFP activity and consider limiting connection duration or implementing rate‑limiting when possible.

Generated by OpenCVE AI on October 20, 2026 at 11:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 20 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
First Time appeared Zephyrproject
Zephyrproject zephyr
Vendors & Products Zephyrproject
Zephyrproject zephyr

Mon, 19 Oct 2026 23:00:00 +0000

Type Values Removed Values Added
Description The Bluetooth Classic Hands-Free Profile HF role in subsys/bluetooth/host/classic/hfp_hf.c does not release the AT command buffers that are still queued on hf->tx_pending when the RFCOMM DLC goes down. hfp_hf_disconnected() only cancelled the work items and cleared hf->acl, and no other code path ever dequeues those buffers, so each one is permanently lost from the fixed hf_pool (CONFIG_BT_MAX_CONN + 1 buffers, i.e. two in the default configuration). The same function also left BT_HFP_HF_FLAG_CONNECTED set, and hfp_hf_create() wiped the object with memset() as soon as hf->acl was NULL, without checking whether hf->work, hf->slc_work or hf->deferred_work was still pending or running. The remote Audio Gateway peer controls the trigger end to end and needs no application involvement: an unsolicited +BCS: 1 response makes bcs_handle() call bt_hfp_hf_select_codec() and queue an AT+BCS buffer, which cannot be transmitted while BT_HFP_HF_FLAG_RX_ONGOING is set, and an immediately following RFCOMM DISC strands that buffer. Repeating the connect / +BCS / disconnect cycle a couple of times empties hf_pool for good. With the pool exhausted, HFP command sending fails permanently, and because hfp_hf_send_cmd() allocates with K_FOREVER (bt_rfcomm_create_pdu() → bt_conn_create_pdu()) from the Bluetooth RX context — where that timeout is not downgraded to K_NO_WAIT — one further +BCS from the peer parks the Bluetooth RX thread inside net_buf_alloc() with no possible waker, halting all HCI event processing until the device is rebooted. Separately, reusing the HF slot while a work handler was still queued or running allowed memset() to wipe live k_work items out from under the system workqueue, corrupting shared kernel workqueue state. Exploitation requires an established HFP session (for SSP devices L2CAP enforces authentication before the RFCOMM channel is reachable) and a build with CONFIG_BT_HFP_HF enabled.
Title Bluetooth Classic HFP Hands-Free: TX buffer leak on RFCOMM disconnect leads to permanent Bluetooth denial of service
Weaknesses CWE-401
References
Metrics cvssV3_1

{'score': 5.7, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Zephyrproject Zephyr
cve-icon MITRE

Status: PUBLISHED

Assigner: zephyr

Published:

Updated: 2026-10-19T22:49:41.900Z

Reserved: 2026-08-21T05:44:58.060Z

Link: CVE-2026-77684

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-19T23:17:37.197

Modified: 2026-10-19T23:17:37.197

Link: CVE-2026-77684

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-20T11:45:14Z

Weaknesses
  • CWE-401

    Missing Release of Memory after Effective Lifetime