CVE-2026-19940

Name of the Vulnerable Software and Affected Versions Zephyr (affected versions not specified)

Description An issue exists in the Bluetooth Classic Hands-Free Profile (HFP) Audio Gateway implementation within the hfp ag.c file. The system manages bt hfp ag objects in a static pool. During link teardown, the hfp ag disconnected() function fails to cancel ag->ongoing call work and ag->slc work. If a new connection reuses the same pool slot, hfp ag create() executes a memset() operation and re-initializes the work item using k work init delayable(). This process leaves the kernel with a reference to a node containing NULL links in the timeout list.

A remote peer can trigger this by sending an AT+CIND? command during Service Level Connection establishment, then disconnecting and immediately re-opening the HFP RFCOMM DLC on the same ACL link. This sequence causes corruption of the kernel timeout list, leading to NULL pointer writes via sys dlist remove() or the creation of a cycle in the announce loop. The result is a system fault or hang, causing a denial of service. This affects builds where CONFIG BT HFP AG is enabled and the application implements the asynchronous get ongoing call callback.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.