Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-82389— Bluetooth Classic HFP AG wipes an object still linked in the SDP request list on connect failure, causing a NULL dereference

Quick assessment

Affected
zephyrproject zephyr
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在蓝牙经典（Bluetooth Classic）免提配置文件（HFP）的音频网关（Audio Gateway, AG）角色中， 中的 函数会向对等设备发起服务发现协议（SDP）发现请求。该请求将嵌入的 节点链接到位于 的 SDP 客户端待处理请求列表中。 如果随后调用的 失败， 会通过 将整个 AG 对象清零进行清理。然而，此时该 SDP 节点仍被链接在请求列表中，且 可能仍被排队在系统工作队列中。由于正在进行的 SDP 发现无法被取消（ 虽在公共头文件中声明，但并无实际实现），该请求将保留在列表中，但其 、 和

CVSS 6.5 · Medium EPSS 0.23% · P14

Affected Version Matrix 1

VendorProduct Version RangeStatus
zephyrproject zephyr 4.4.0< 4.5.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-82389

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Bluetooth Classic HFP AG wipes an object still linked in the SDP request list on connect failure, causing a NULL dereference
Source: CVE Program / CVE List V5
Vulnerability Description
In the Bluetooth Classic Hands-Free Profile Audio Gateway role, hfp_ag_create() in subsys/bluetooth/host/classic/hfp_ag.c starts an SDP discovery toward the peer, which links the embedded ag->sdp_param._node into the SDP client's pending request list in subsys/bluetooth/host/classic/sdp.c. If the subsequent bt_rfcomm_dlc_connect() call fails, bt_hfp_ag_connect() cleaned up by memset()-ing the entire AG object while that node was still linked, and while ag->slc_work could still be queued on the system work queue. An in-flight SDP discovery cannot be cancelled — bt_sdp_discover_cancel() is declared in the public header but has no implementation — so the request stays in the list with its func, pool and uuid pointers zeroed. The RFCOMM channel passed to bt_hfp_ag_connect() is taken from the peer's own SDP Hands-Free service record in the normal AG flow (bt_sdp_get_proto_param() performs no range validation, and samples/bluetooth/classic/handsfree_ag feeds the value straight through), so a remote BR/EDR device in radio range that advertises an RFCOMM channel outside the valid range 0x01..0x1e deterministically forces bt_rfcomm_dlc_connect() to fail and reach the wipe. Reading the peer's SDP record requires no pairing, and the peer can also trigger the failure by dropping the ACL or racing an RFCOMM DLC on the same DLCI at the right moment. When the SDP client next advances its request list, sdp_client_discover() dereferences the zeroed parameters — net_buf_alloc(param->pool, …) with a NULL pool and param->uuid->type — and the result-notification paths call through the NULL params->func. Zeroing a linked node also truncates the request list behind a stale tail pointer, and re-arming the freed AG slot re-appends the same node and can produce a self-looping list that hangs the Bluetooth RX thread. The impact is a crash or hang of the Bluetooth stack; the written value is a constant zero at a fixed static address, so no attacker-controlled write is available. Only builds with CONFIG_BT_CLASSIC and CONFIG_BT_HFP_AG that use the Audio Gateway role are affected.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
空指针解引用
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
zephyrproject zephyr 4.4.0 ~ 4.5.0 -

II. Public POCs for CVE-2026-82389

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-82389

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-82389 (1)

Vendor Advisories for CVE-2026-82389 (1)

Same Patch Batch · zephyrproject · 2026-10-26 · 6 CVEs total

CVE-2026-81038 7.1 HIGH Bluetooth OTS server discloses uninitialized stack memory in failed Calculate Checksum res
CVE-2026-82388 5.3 MEDIUM Use of a released HFP HF object after a failed RFCOMM connect in the Bluetooth Classic hos
CVE-2026-81039 4.3 MEDIUM Bluetooth Host connection reservation leak when multiple connectable advertising sets shar
CVE-2026-19742 3.7 LOW IPv6 stable and temporary interface identifiers derived from a non-cryptographic PRNG secr
CVE-2026-82390 3.7 LOW Cross-session AES key confusion in the Espressif ESP32 hardware crypto driver

IV. Related Vulnerabilities

Same product: zephyr
Same vendor: zephyrproject
Same weakness: CWE-476