CVE-2026-77684

Name of the Vulnerable Software and Affected Versions Zephyr (affected versions not specified)

Description An issue exists in the Bluetooth Classic Hands-Free Profile (HFP) HF role within subsys/bluetooth/host/classic/hfp hf.c. The system fails to release AT command buffers queued on hf->tx pending when the RFCOMM DLC goes down. Because hfp hf disconnected() only cancels work items and clears hf->acl, these buffers are permanently lost from the fixed hf pool. A remote Audio Gateway peer can trigger this by sending an unsolicited +BCS: 1 response, causing bcs handle() to call bt hfp hf select codec() and queue an AT+BCS buffer. If an RFCOMM DISC follows immediately, the buffer is stranded. Repeating this cycle exhausts the hf pool, causing HFP command sending to fail. Furthermore, hfp hf send cmd() allocates with K FOREVER via bt rfcomm create pdu() and bt conn create pdu() from the Bluetooth RX context, which can park the Bluetooth RX thread inside net buf alloc(), halting all HCI event processing until a reboot. Additionally, reusing the HF slot while work handlers are pending allows memset() to wipe live k work items, corrupting the shared kernel workqueue state. Exploitation requires an established HFP session and a build with CONFIG BT HFP HF enabled.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.