CVE-2026-19940

The Bluetooth Classic Hands-Free Profile Audio Gateway implementation in subsys/bluetooth/host/classic/hfp_ag.c keeps its struct bt_hfp_ag objects in a static pool indexed by ACL connection index. On link teardown, hfp_ag_disconnected() cancels ag->tx_work and the per-call work items and then clears ag->acl_conn, which marks the pool slot as free — but it leaves ag->ongoing_call_work (and ag->slc_work) untouched. The next connection that lands on the same slot enters hfp_ag_create(), whose only occupancy test is ag->acl_conn, and immediately executes memset(ag, 0, sizeof(struct bt_hfp_ag)) followed by k_work_init_delayable(). Zeroing and re-initialising a k_work_delayable whose struct _timeout node is still linked into the kernel timeout list leaves the kernel holding a reference to a node with NULL prev/next links. ag->ongoing_call_work is armed by the remote peer: when a Hands-Free unit sends AT+CIND? during Service Level Connection establishment and the application provides the asynchronous get_ongoing_call callback, the AG schedules the work for CONFIG_BT_HFP_AG_GET_ONGOING_CALL_TIMEOUT milliseconds (default 10000). The timer is cancelled only if the application answers in time via bt_hfp_ag_ongoing_calls(). A peer that sends AT+CIND?, then disconnects the HFP RFCOMM DLC, then immediately re-opens it on the same ACL link, reuses the same pool slot deterministically while the timeout is still pending — the AG's RFCOMM server accept path (hfp_ag_accept()) calls hfp_ag_create() directly, so the remote side drives both teardown and re-creation. The result is corruption of the kernel's timeout list: sys_dlist_remove() on the zeroed node performs writes through NULL pointers from the clock-announce path, and rescheduling the re-initialised work re-inserts a node the list already references, creating a cycle that the announce loop walks with interrupts locked. The observable impact is a fault or hang of the whole system, i.e. a denial of service reachable from Bluetooth radio range; no attacker-controlled data is written, so this does not by itself yield code execution. Exposure is limited to builds with CONFIG_BT_HFP_AG (marked experimental and disabled by default) whose application implements the asynchronous get_ongoing_call callback.

• CWE-416

• https://github.com/zephyrproject-rtos/zephyr/commit/204c36b896fe8d68ca3cb3d00216f245f91d14be
• https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-v47w-8959-rx62

Published

Oct 13, 2026

Last Modified

Oct 14, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-19935The Bluetooth LE host queues received L2CAP connection-orien…7.5
• CVE-2026-19936The Bluetooth Mesh Access-layer delayable message queue in s…4.8
• CVE-2026-19937The Bluetooth Mesh Access layer delayable-message machinery …5.7
• CVE-2026-19938The Bluetooth host's ATT transmit path releases a buffer it …5.9
• CVE-2026-19939The AVDTP signalling layer arms a 6-second command timeout (…6.3
• CVE-2026-1994The s2Member plugin for WordPress is vulnerable to privilege…9.8
• CVE-2026-19941An inapplicable NSEC record may be accepted by a `named` res…5.9
• CVE-2026-19942The Atarim – AI Agency for WordPress: Edit Pages, Fix Code, …8.1
• CVE-2026-19943The Gutenverse – WordPress Blocks, Page Builder & Site Edito…6.4
• CVE-2026-19944The WP Crowdfunding plugin for WordPress is vulnerable to ge…4.9
• CVE-2026-19945The WP Crowdfunding plugin for WordPress is vulnerable to St…6.4
• CVE-2026-19946The Awesome Support plugin for WordPress is vulnerable to Mi…4.3