CVE-2026-85033

The AVRCP Target role in subsys/bluetooth/host/classic/avrcp.c keeps its vendor-dependent response transmit state in a per-connection object selected by connection index (get avrcp tg()), with the per-transfer context (tid, sent len, and the BT AVRCP TG FLAG TX ONGOING flag) stored in the user data of the queued response net buf. The AVCTP teardown handler avrcp disconnected() did not cancel tg->vd rsp tx work and did not release the buffers still queued on tg->vd rsp tx pending, so a link drop in the middle of a fragmented response left the buffer on the list with TX ONGOING still set.

A remote AVRCP Controller can trigger this deterministically: it issues a vendor-dependent command whose response exceeds one AVRCP fragment (for example GetElementAttributes or GetCapabilities), lets bt avrcp tg vendor tx work() emit the START fragment, and then drops the ACL link instead of sending REQUEST CONTINUING RESPONSE. The AVCTP control channel requires an encrypted BR/EDR link (BT SECURITY L2), so the attacker must be a paired peer within radio range; no user interaction is needed.

Because the Target objects are static and reused, the next connection landing on the same connection index finds the stale buffer at the head of vd rsp tx pending. Every run of the TX work sees TX ONGOING and returns immediately, so all further vendor-dependent responses queue behind the stale head and are never sent — a persistent loss of AVRCP Target function that no timeout clears and only a reboot recovers. Each cycle also leaks one response buffer from a shallow application pool, and a new peer that sends REQUEST CONTINUING RESPONSE clears the stale TX ONGOING via bt avrcp tg process continuing cmd(), causing the un-sent remainder of the previous peer's response to be transmitted to it.

The fix cancels tg->vd rsp tx work and unrefs every buffer on tg->vd rsp tx pending in avrcp disconnected(); since the TX context lives in the buffer user data, releasing the buffers also resets the TX state machine. There is no memory corruption: the pre-fix buffer is leaked with a live reference, so no use-after-free arises.