CVE-2026-82389— 蓝牙 HFP AG 连接失败时 NULL 解引用漏洞
一分钟漏洞结论
影响对象
zephyrproject zephyr
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
在蓝牙经典（Bluetooth Classic）免提配置文件（HFP）的音频网关（Audio Gateway, AG）角色中， 中的 函数会向对等设备发起服务发现协议（SDP）发现请求。该请求将嵌入的 节点链接到位于 的 SDP 客户端待处理请求列表中。 如果随后调用的 失败， 会通过 将整个 AG 对象清零进行清理。然而，此时该 SDP 节点仍被链接在请求列表中，且 可能仍被排队在系统工作队列中。由于正在进行的 SDP 发现无法被取消（ 虽在公共头文件中声明，但并无实际实现），该请求将保留在列表中，但其 、 和
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-82389 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Bluetooth Classic HFP AG wipes an object still linked in the SDP request list on connect failure, causing a NULL dereference
来源: CVE Program / CVE List V5
Vulnerability Description
In the Bluetooth Classic Hands-Free Profile Audio Gateway role, hfp_ag_create() in subsys/bluetooth/host/classic/hfp_ag.c starts an SDP discovery toward the peer, which links the embedded ag->sdp_param._node into the SDP client's pending request list in subsys/bluetooth/host/classic/sdp.c. If the subsequent bt_rfcomm_dlc_connect() call fails, bt_hfp_ag_connect() cleaned up by memset()-ing the entire AG object while that node was still linked, and while ag->slc_work could still be queued on the system work queue. An in-flight SDP discovery cannot be cancelled — bt_sdp_discover_cancel() is declared in the public header but has no implementation — so the request stays in the list with its func, pool and uuid pointers zeroed.
The RFCOMM channel passed to bt_hfp_ag_connect() is taken from the peer's own SDP Hands-Free service record in the normal AG flow (bt_sdp_get_proto_param() performs no range validation, and samples/bluetooth/classic/handsfree_ag feeds the value straight through), so a remote BR/EDR device in radio range that advertises an RFCOMM channel outside the valid range 0x01..0x1e deterministically forces bt_rfcomm_dlc_connect() to fail and reach the wipe. Reading the peer's SDP record requires no pairing, and the peer can also trigger the failure by dropping the ACL or racing an RFCOMM DLC on the same DLCI at the right moment.
When the SDP client next advances its request list, sdp_client_discover() dereferences the zeroed parameters — net_buf_alloc(param->pool, …) with a NULL pool and param->uuid->type — and the result-notification paths call through the NULL params->func. Zeroing a linked node also truncates the request list behind a stale tail pointer, and re-arming the freed AG slot re-appends the same node and can produce a self-looping list that hangs the Bluetooth RX thread. The impact is a crash or hang of the Bluetooth stack; the written value is a constant zero at a fixed static address, so no attacker-controlled write is available.
Only builds with CONFIG_BT_CLASSIC and CONFIG_BT_HFP_AG that use the Audio Gateway role are affected.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
来源: CVE Program / CVE List V5
Vulnerability Type
空指针解引用
来源: CVE Program / CVE List V5
受影响产品
| 厂商 | 产品 | 影响版本 | CPE | 订阅 |
|---|---|---|---|---|
| zephyrproject | zephyr | 4.4.0 ~ 4.5.0 | - |
|
二、漏洞 CVE-2026-82389 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-82389 的情报信息
请登录查看更多情报信息。
CVE-2026-82389 补丁与修复 (1)
CVE-2026-82389 厂商安全公告 (1)
同批安全公告 · zephyrproject · 2026-10-26 · 共 6 条
| CVE-2026-81038 | 7.1 HIGH | 蓝牙 OTS 服务器计算校验和失败时泄露未初始化栈内存 |
| CVE-2026-82388 | 5.3 MEDIUM | 蓝牙经典主机 HFP 对象释放后使用漏洞 |
| CVE-2026-81039 | 4.3 MEDIUM | 蓝牙主机多连接集共享身份时的连接预留泄露漏洞 |
| CVE-2026-19742 | 3.7 LOW | IPv6 接口标识符非加密随机数生成器密钥泄露漏洞 |
| CVE-2026-82390 | 3.7 LOW | ESP32 硬件加密驱动跨会话 AES 密钥混淆漏洞 |