CVE-2026-10641: Zephyr Bluetooth HFP DoS Vulnerability

CVE-2026-10641 Overview

CVE-2026-10641 is an out-of-bounds write vulnerability in the Zephyr Real-Time Operating System (RTOS) Bluetooth Classic Hands-Free Profile (HFP) Hands-Free role parser. The flaw resides in subsys/bluetooth/host/classic/hfp_hf.c within the cind_handle_values() function. A malicious, compromised, or spoofed Audio Gateway (AG) peer can send a crafted +CIND: response with more than 20 recognized indicator entries, driving an attacker-controlled index past the bounds of the 20-element int8_t ind_table[] array. The condition triggers memory corruption with no user interaction over an adjacent Bluetooth connection.

Critical Impact
A single malformed AT response from a connected Bluetooth peer causes memory corruption and at least denial of service of the Bluetooth host on devices running CONFIG_BT_HFP_HF builds.

Affected Products

Zephyr RTOS builds with CONFIG_BT_HFP_HF enabled
Zephyr versions from approximately v1.7 (original HFP HF CIND parser introduction)
Zephyr versions through v4.4.0

Discovery Timeline

2026-06-17 - CVE-2026-10641 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-10641

Vulnerability Analysis

The vulnerability occurs during Service Level Connection (SLC) setup between the Hands-Free (HF) device and the Audio Gateway (AG). The HF sends AT+CIND=? and parses the AG's +CIND: response in cind_handle(). That function assigns a per-entry counter index and calls cind_handle_values() for each list element. The consumer writes hf->ind_table[index] = i without verifying that index falls within the bounds of the 20-element int8_t ind_table[] field in struct bt_hfp_hf. This is classified as an out-of-bounds write [CWE-787].

Root Cause

The parser places no cap on the number of +CIND: list entries it accepts from the AG. The sibling consumer ag_indicator_handle_values() already performed an equivalent bounds check, but cind_handle_values() did not. The missing guard allows an attacker to drive index arbitrarily large and write attacker-positioned values past the array into adjacent struct fields including feature masks, SDP/version state, the calls[] array, and work/atomic bookkeeping. The corruption can extend beyond the static connection pool slot.

Attack Vector

Exploitation requires an adjacent network position over Bluetooth. The attacker operates a malicious, compromised, or spoofed AG peer that the Zephyr device connects to. After the SLC handshake begins, the AG responds to AT+CIND=? with a malformed indicator list containing more than 20 recognized entries. No authentication beyond standard Bluetooth pairing and no user interaction is required to trigger the corruption.

// Patch applied to subsys/bluetooth/host/classic/hfp_hf.c
	LOG_DBG("index: %u, name: %s, min: %u, max:%u", index, name, min, max);

+	if (index >= ARRAY_SIZE(hf->ind_table)) {
+		LOG_WRN("Invalid indicator index: %u", index);
+		return;
+	}
+
	for (i = 0; i < ARRAY_SIZE(ag_ind); i++) {
		if (strcmp(name, ag_ind[i].name) != 0) {
			continue;

Source: Zephyr GitHub Commit cf7693a

Detection Methods for CVE-2026-10641

Indicators of Compromise

Unexpected crashes or reboots of Zephyr-based devices during Bluetooth HFP Service Level Connection setup.
Log warnings referencing invalid indicator indices in cind_handle_values() after applying the patch.
Bluetooth host fault traces correlated with connections to unknown or untrusted Audio Gateway peers.

Detection Strategies

Audit firmware builds for CONFIG_BT_HFP_HF=y and confirm the Zephyr source tree includes commit cf7693a8261ae363c9cf46cfd51005486637173e.
Inspect Bluetooth HCI traces for +CIND: responses containing more than 20 indicator list entries during SLC negotiation.
Review device crash dumps for stack or heap corruption originating in subsys/bluetooth/host/classic/hfp_hf.c.

Monitoring Recommendations

Enable verbose Bluetooth host logging on test devices to capture malformed AT responses during pairing operations.
Monitor field deployments for repeated Bluetooth subsystem restarts that may signal exploitation attempts.
Track Zephyr security advisories from the Zephyr Project for related HFP and Bluetooth Classic disclosures.

How to Mitigate CVE-2026-10641

Immediate Actions Required

Apply the upstream fix from commit cf7693a8261ae363c9cf46cfd51005486637173e and rebuild affected firmware.
Inventory devices running Zephyr with CONFIG_BT_HFP_HF enabled and prioritize patch rollout.
Restrict Bluetooth pairing to trusted Audio Gateway devices until patched firmware is deployed.

Patch Information

The fix adds an index >= ARRAY_SIZE(hf->ind_table) bounds check inside cind_handle_values() before the indexed write. Details are available in the Zephyr Security Advisory GHSA-wx5j-q6f2-59p3 and the upstream commit. Update to a Zephyr release containing the fix beyond v4.4.0.

Workarounds

Disable CONFIG_BT_HFP_HF in Kconfig if the Hands-Free role is not required for the product.
Limit Bluetooth discoverability and require operator confirmation before connecting to new Audio Gateway peers.
Maintain an allowlist of known-good AG device addresses at the application layer.

bash

# Disable the vulnerable HFP Hands-Free role in Zephyr Kconfig
CONFIG_BT_HFP_HF=n