---
id: CVE-2026-19940
title: >-
  The Bluetooth Classic Hands-Free Profile Audio Gateway implementation in
  subsys/bluetooth/host/classic/hfp_ag.c keeps its struct bt_hfp_ag objects in a
  static pool indexed by ACL connection index
summary: >-
  The Bluetooth Classic Hands-Free Profile Audio Gateway implementation in
  subsys/bluetooth/host/classic/hfp_ag.c keeps its struct bt_hfp_ag objects in a
  static pool indexed by ACL connection index. On link teardown,
  hfp_ag_disconnected() …
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-416
published: '2026-10-13'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T20:20:25.657'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-19940'
references:
  - url: >-
      https://github.com/zephyrproject-rtos/zephyr/commit/204c36b896fe8d68ca3cb3d00216f245f91d14be
    label: vulnerabilities@zephyrproject.org
  - url: >-
      https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-v47w-8959-rx62
    label: vulnerabilities@zephyrproject.org
tags:
  - nvd
ingestedAt: '2026-10-13T17:38:53.194Z'
---

## Overview

The Bluetooth Classic Hands-Free Profile Audio Gateway implementation in subsys/bluetooth/host/classic/hfp_ag.c keeps its struct bt_hfp_ag objects in a static pool indexed by ACL connection index. On link teardown, hfp_ag_disconnected() cancels ag->tx_work and the per-call work items and then clears ag->acl_conn, which marks the pool slot as free — but it leaves ag->ongoing_call_work (and ag->slc_work) untouched. The next connection that lands on the same slot enters hfp_ag_create(), whose only occupancy test is ag->acl_conn, and immediately executes memset(ag, 0, sizeof(struct bt_hfp_ag)) followed by k_work_init_delayable(). Zeroing and re-initialising a k_work_delayable whose struct _timeout node is still linked into the kernel timeout list leaves the kernel holding a reference to a node with NULL prev/next links.

ag->ongoing_call_work is armed by the remote peer: when a Hands-Free unit sends AT+CIND? during Service Level Connection establishment and the application provides the asynchronous get_ongoing_call callback, the AG schedules the work for CONFIG_BT_HFP_AG_GET_ONGOING_CALL_TIMEOUT milliseconds (default 10000). The timer is cancelled only if the application answers in time via bt_hfp_ag_ongoing_calls(). A peer that sends AT+CIND?, then disconnects the HFP RFCOMM DLC, then immediately re-opens it on the same ACL link, reuses the same pool slot deterministically while the timeout is still pending — the AG's RFCOMM server accept path (hfp_ag_accept()) calls hfp_ag_create() directly, so the remote side drives both teardown and re-creation.

The result is corruption of the kernel's timeout list: sys_dlist_remove() on the zeroed node performs writes through NULL pointers from the clock-announce path, and rescheduling the re-initialised work re-inserts a node the list already references, creating a cycle that the announce loop walks with interrupts locked. The observable impact is a fault or hang of the whole system, i.e. a denial of service reachable from Bluetooth radio range; no attacker-controlled data is written, so this does not by itself yield code execution. Exposure is limited to builds with CONFIG_BT_HFP_AG (marked experimental and disabled by default) whose application implements the asynchronous get_ongoing_call callback.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.