CVE-2026-77684: Bluetooth HFP Buffer Leak DOS Vulnerability

CVE-2026-77684 Overview

CVE-2026-77684 is a memory leak and denial-of-service vulnerability in the Zephyr RTOS Bluetooth Classic Hands-Free Profile (HFP) Hands-Free (HF) role, located in subsys/bluetooth/host/classic/hfp_hf.c. The HF disconnect handler fails to release AT command buffers queued on hf->tx_pending when the underlying RFCOMM Data Link Connection (DLC) goes down. Repeated connect, +BCS, and disconnect cycles from a paired Audio Gateway peer permanently exhaust the fixed hf_pool. Once drained, the Bluetooth RX thread blocks indefinitely in net_buf_alloc() with K_FOREVER, halting all Host Controller Interface (HCI) event processing until reboot.

Critical Impact
An authenticated adjacent Bluetooth peer can permanently exhaust the HFP buffer pool and hang the Bluetooth RX thread, requiring a device reboot to restore functionality.

Affected Products

Zephyr RTOS builds with CONFIG_BT_HFP_HF enabled
Bluetooth Classic Hands-Free Profile HF role implementation
Devices using the default CONFIG_BT_MAX_CONN + 1 buffer pool configuration

Discovery Timeline

2026-10-19 - CVE-2026-77684 published to NVD
2026-10-20 - Last updated in NVD database

Technical Details for CVE-2026-77684

Vulnerability Analysis

The flaw is a memory leak classified under [CWE-401]. The hfp_hf_disconnected() function in hfp_hf.c cancels work items and clears hf->acl when the RFCOMM DLC terminates. It does not drain buffers still queued on hf->tx_pending. No other code path dequeues those buffers, so each strand is permanently lost from the fixed hf_pool, which holds only two buffers in the default configuration.

The same function leaves BT_HFP_HF_FLAG_CONNECTED set after teardown. When hfp_hf_create() reuses the slot, it wipes the object with memset() as soon as hf->acl is NULL. The memset occurs without checking whether hf->work, hf->slc_work, or hf->deferred_work is still pending or running. This corrupts live k_work items inside the system workqueue, damaging shared kernel state.

Root Cause

The root cause combines missing buffer cleanup on disconnect with unsafe object reuse. The tx_pending FIFO retains buffers that no sender will ever transmit, because transmission is gated by BT_HFP_HF_FLAG_RX_ONGOING. Reuse of the slot wipes active work handlers without synchronization.

Attack Vector

The remote Audio Gateway peer controls the trigger end-to-end. An unsolicited +BCS: 1 response causes bcs_handle() to invoke bt_hfp_hf_select_codec() and queue an AT+BCS buffer. The buffer cannot be transmitted while BT_HFP_HF_FLAG_RX_ONGOING is set. An immediately following RFCOMM DISC strands that buffer. Repeating the cycle a few times empties hf_pool. Once exhausted, hfp_hf_send_cmd() allocates with K_FOREVER via bt_rfcomm_create_pdu() from the Bluetooth RX context, where the timeout is not downgraded to K_NO_WAIT. One further +BCS parks the RX thread inside net_buf_alloc() with no possible waker.

 static void hfp_hf_disconnected(struct bt_rfcomm_dlc *dlc)
 {
 	struct bt_hfp_hf *hf = CONTAINER_OF(dlc, struct bt_hfp_hf, rfcomm_dlc);
+	struct net_buf *buf;
 
 	LOG_DBG("hf disconnected!");
 	if (bt_hf->disconnected) {
 		bt_hf->disconnected(hf);
 	}
 
+	/* Stop the senders before draining the TX queue below: with the flag
+	 * cleared, command senders are rejected with -ENOTCONN instead of
+	 * queueing buffers that nothing will ever send.
+	 */
+	atomic_clear_bit(hf->flags, BT_HFP_HF_FLAG_CONNECTED);
+
 	k_work_cancel(&hf->work);
 	k_work_cancel_delayable(&hf->deferred_work);
+
+	buf = k_fifo_get(&hf->tx_pending, K_NO_WAIT);
+	while (buf != NULL) {
+		net_buf_unref(buf);
+		buf = k_fifo_get(&hf->tx_pending, K_NO_WAIT);

Source: Zephyr commit 59c947c7

Detection Methods for CVE-2026-77684

Indicators of Compromise

Bluetooth RX thread blocked indefinitely inside net_buf_alloc() without progress
HCI event processing halts and the device becomes unresponsive to Bluetooth traffic until reboot
Repeated short-lived HFP sessions from the same Audio Gateway containing unsolicited +BCS: 1 responses followed by RFCOMM DISC
Depleted hf_pool observed through debug logs or heap inspection

Detection Strategies

Instrument hfp_hf_disconnected() and hfp_hf_send_cmd() to log buffer allocation and release counts for the hf_pool
Monitor the Bluetooth RX thread state and alert when it remains blocked on net_buf_alloc() beyond a reasonable threshold
Capture over-the-air Bluetooth traces and inspect for cyclic HFP connect, +BCS, DISC patterns from a single peer

Monitoring Recommendations

Track Bluetooth stack health counters including pending work items and buffer pool utilization
Alert on firmware watchdog triggers or forced reboots correlated with Bluetooth activity
Log all HFP SLC (Service Level Connection) establishment and teardown events for post-incident review

How to Mitigate CVE-2026-77684

Immediate Actions Required

Apply the upstream Zephyr patch from commit 59c947c71f3d9ab4cf10fd28846e6ca4a3d53819 to fix the HF teardown and object reuse flaws
Rebuild and reflash affected firmware images that enable CONFIG_BT_HFP_HF
Restrict HFP pairing to trusted Audio Gateway devices and audit existing bonded peers

Patch Information

The fix is published in the Zephyr project under advisory GHSA-hc6x-8gm2-2r9v. The patch drains hf->tx_pending on disconnect, clears BT_HFP_HF_FLAG_CONNECTED before draining so new senders are rejected with -ENOTCONN, and ensures work handlers are properly cancelled before slot reuse. See the Zephyr commit for the full diff.

Workarounds

Disable CONFIG_BT_HFP_HF in Zephyr build configuration if the Hands-Free role is not required
Limit Bluetooth Classic discoverability and pairing windows to reduce exposure to adjacent attackers
Implement application-level watchdog recovery to detect and reset a hung Bluetooth RX thread

bash

# Disable HFP HF role in Zephyr Kconfig if unused
CONFIG_BT_HFP_HF=n