CVE-2026-82388

Name of the Vulnerable Software and Affected Versions Zephyr (affected versions not specified)

Description An issue exists in the Bluetooth host where the bt hfp hf connect() function in subsys/bluetooth/host/classic/hfp hf.c improperly handles object cleanup during a failed connection. When bt rfcomm dlc connect() fails, the code clears the HFP Hands-Free object using memset() while an SDP discovery is still active. This process zeros out critical pointers and the node linked in the SDP client's request list (session->reqs in subsys/bluetooth/host/classic/sdp.c), as well as the hf->slc work work item.

This state can be triggered by a remote device providing an RFCOMM channel value outside the 1-30 range, or through specific connection timing, such as when the ACL is dropped. Subsequent operations lead to a null pointer dereference in sdp client alloc buf() or a call to a null function pointer in the SDP receive paths. Additionally, the cleanup process can create a self-referential list in session->reqs, causing the Bluetooth host thread to hang or fault. This results in a denial of service. The issue only affects builds with CONFIG BT CLASSIC and CONFIG BT HFP HF enabled.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.