CVE-2026-19940: Bluetooth Classic HFP Audio Gateway DoS

CVE-2026-19940 Overview

CVE-2026-19940 is a use-after-free vulnerability [CWE-416] in the Zephyr RTOS Bluetooth Classic Hands-Free Profile Audio Gateway (HFP AG) implementation. The flaw lives in subsys/bluetooth/host/classic/hfp_ag.c, where hfp_ag_disconnected() cancels only a subset of pending work items before freeing the connection slot. A remote Bluetooth peer in radio range can drive teardown and re-creation of the same pool slot while ag->ongoing_call_work remains armed, corrupting the kernel timeout list and hanging the device.

Critical Impact
A peer within Bluetooth radio range can trigger a kernel timeout list corruption that faults or hangs the entire system, producing a denial of service with no authentication or user interaction.

Affected Products

Zephyr RTOS builds with CONFIG_BT_HFP_AG enabled (experimental, disabled by default)
Applications implementing the asynchronous get_ongoing_call callback
Devices exposing the Bluetooth Classic HFP Audio Gateway RFCOMM service

Discovery Timeline

2026-10-13 - CVE-2026-19940 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-19940

Vulnerability Analysis

The bt_hfp_ag structures live in a static pool indexed by Access Control Link (ACL) connection index. On link teardown, hfp_ag_disconnected() cancels ag->tx_work and per-call work items, then clears ag->acl_conn to mark the slot free. It leaves ag->ongoing_call_work and ag->slc_work untouched.

The next connection that lands on the same slot enters hfp_ag_create(), which tests only ag->acl_conn for occupancy. It then calls memset(ag, 0, sizeof(struct bt_hfp_ag)) followed by k_work_init_delayable(). Zeroing a k_work_delayable whose struct _timeout node remains linked in the kernel timeout list leaves the kernel holding a reference to a node with NULL prev/next pointers.

Root Cause

The root cause is incomplete work-item cancellation during disconnect combined with an occupancy check that does not account for in-flight timers. The timeout node remains linked while its backing memory is reinitialized and reused.

Attack Vector

A remote Hands-Free unit sends AT+CIND? during Service Level Connection establishment. If the application registers the asynchronous get_ongoing_call callback, the AG schedules ongoing_call_work for CONFIG_BT_HFP_AG_GET_ONGOING_CALL_TIMEOUT milliseconds (default 10000). The peer then disconnects the HFP RFCOMM Data Link Connection (DLC) and immediately re-opens it on the same ACL link. The AG's RFCOMM accept path (hfp_ag_accept()) calls hfp_ag_create() directly, so the peer deterministically reuses the pool slot while the timer is still pending.

Subsequent sys_dlist_remove() on the zeroed node writes through NULL pointers from the clock-announce path. Rescheduling the re-initialized work re-inserts a node the list already references, creating a cycle that the announce loop walks with interrupts locked.

 	struct bt_hfp_ag_call *call;
 
 	k_work_cancel_delayable(&ag->tx_work);
+	k_work_cancel_delayable(&ag->ongoing_call_work);
+	k_work_cancel(&ag->slc_work);
 
 	tx = ag_get_tx(ag, &ag->tx_pending);
 	while (tx != NULL) {

Source: Zephyr commit 204c36b. The patch adds explicit cancellation of ongoing_call_work and slc_work in the disconnect handler.

Detection Methods for CVE-2026-19940

Indicators of Compromise

Unexplained system hangs or kernel faults on Zephyr-based devices shortly after Bluetooth HFP activity
Bluetooth peer repeatedly issuing AT+CIND? followed by rapid RFCOMM DLC teardown and reconnect on the same ACL link
Kernel log entries referencing sys_dlist_remove NULL dereferences or timeout-list corruption

Detection Strategies

Audit firmware builds for CONFIG_BT_HFP_AG=y combined with an application-provided asynchronous get_ongoing_call callback
Review Bluetooth HCI traces for rapid RFCOMM channel open/close sequences from a single remote address during Service Level Connection establishment
Monitor for watchdog-triggered resets on devices exposing HFP AG services

Monitoring Recommendations

Enable Bluetooth stack debug logging to capture hfp_ag_create() and hfp_ag_disconnected() call sequences
Track device availability metrics for fleet-deployed Zephyr endpoints to detect clusters of hangs correlated with Bluetooth exposure
Capture over-the-air Bluetooth traffic in test environments to identify malformed HFP state transitions

How to Mitigate CVE-2026-19940

Immediate Actions Required

Apply the upstream Zephyr fix in commit 204c36b896fe8d68ca3cb3d00216f245f91d14be and rebuild affected firmware images
Inventory devices with CONFIG_BT_HFP_AG enabled and prioritize patching those implementing the asynchronous get_ongoing_call callback
Restrict Bluetooth discoverability and pairing on affected devices until patched firmware is deployed

Patch Information

The fix is published in the Zephyr project repository. See Zephyr commit 204c36b and the GitHub Security Advisory GHSA-v47w-8959-rx62. The patch adds k_work_cancel_delayable(&ag->ongoing_call_work) and k_work_cancel(&ag->slc_work) to the disconnect handler so no timer or work node remains linked when the pool slot is reused.

Workarounds

Disable CONFIG_BT_HFP_AG in the Zephyr build configuration if the Hands-Free Audio Gateway is not required
Remove or stub the asynchronous get_ongoing_call callback so ongoing_call_work is never armed
Place devices in environments outside Bluetooth radio range of untrusted peers until the patch is applied

bash

# Disable the vulnerable experimental feature in prj.conf
CONFIG_BT_HFP_AG=n