Use of a released HFP HF object after a failed RFCOMM connect in the Bluetooth Classic host

{
  "id": "dd696479d8a5ec7360088286e42a27fdf8143cff633e1d238963366ae748c9e0",
  "url": "https://www.cve.org/CVERecord?id=CVE-2026-82388",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Use of a released HFP HF object after a failed RFCOMM connect in the Bluetooth Classic host",
    "summary": "bt_hfp_hf_connect() in subsys/bluetooth/host/classic/hfp_hf.c allocates the per-connection HFP Hands-Free object with hfp_hf_create(), which starts an SDP discovery by passing the object's embedded hf->sdp_param to bt_sdp_discover(). That call links the caller-owned parameter block into the SDP client's request list (session->reqs in subsys/bluetooth/host/classic/sdp.c). If the subsequent bt_rfcomm_dlc_connect() then failed, the affected code wiped the entire object with (void)memset(new_hf, 0, sizeof(*new_hf)) while that discovery was still outstanding, zeroing the sys_snode_t _node that is still linked in the SDP client's list along with the request's func, uuid and pool pointers, and zeroing the hf->slc_work work item that may already be queued on the system workqueue. The discovery could not be retracted instead: bt_sdp_discover_cancel() is declared in include/zephyr/bluetooth/classic/sdp.h but has no implementation. The failing branch is reachable with peer-supplied input. The documented use of bt_hfp_hf_connect() is to pass the RFCOMM channel read out of the remote Audio Gateway's SDP record; neither bt_sdp_get_proto_param() nor bt_hfp_hf_connect() range-checks that value, so a remote device advertising an HFP AG record with an RFCOMM channel outside 1-30 makes bt_rfcomm_dlc_connect() return -EINVAL and drives the local device into the wipe. The same branch is reached without any application misuse when the remote peer controls connection timing, for example when the RF",
    "evidence": "cve:CVE-2026-82388",
    "products": [
      {
        "name": {
          "value": "zephyr",
          "evidence": "/containers/cna/affected/0/product"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": []
      }
    ],
    "severity": "medium",
    "structured": {
      "id": "CVE-2026-82388",
      "aliases": [
        "CVE-2026-82388"
      ],
      "metrics": [
        {
          "format": "CVSS",
          "cvssV3_1": {
            "version": "3.1",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
          }
        }
      ],
      "affected": [
        {
          "vendor": "zephyrproject",
          "product": "zephyr",
          "versions": [
            {
              "status": "affected",
              "version": "4.4.0",
              "lessThan": "4.5.0",
              "versionType": "semver"
            }
          ],
          "packageName": "zephyr",
          "programFiles": [
            "subsys/bluetooth/host/classic/hfp_hf.c",
            "subsys/bluetooth/host/classic/hfp_hf_internal.h"
          ],
          "collectionURL": "https://github.com/zephyrproject-rtos/zephyr",
          "defaultStatus": "unaffected",
          "programRoutines": [
            {
              "name": "bt_hfp_hf_connect"
            },
            {
              "name": "hfp_hf_create"
            }
          ]
        }
      ],
      "modified": "2026-10-26T17:37:10.831Z",
      "provider": "cve",
      "references": [
        "https://github.com/zephyrproject-rtos/zephyr/commit/6119da5d632594131304dec85000a75dc17743d2",
        "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-398x-f7rq-5jj9"
      ],
      "provider_metadata": {
        "adp": [
          {
            "title": "CISA ADP Vulnrichment",
            "metrics": [
              {
                "other": {
                  "type": "ssvc",
                  "content": {
                    "id": "CVE-2026-82388",
                    "role": "CISA Coordinator",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "version": "2.0.3",
                    "timestamp": "2026-10-26T16:49:39.950513Z"
                  }
                }
              }
            ],
            "providerMetadata": {
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP",
              "dateUpdated": "2026-10-26T17:37:10.831Z"
            }
          }
        ],
        "cna": {
          "orgId": "e2e69745-5e70-4e92-8431-deb5529a81ad",
          "shortName": "zephyr",
          "dateUpdated": "2026-10-26T16:08:52.433Z"
        }
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-82388",
        "evidence": "/cveMetadata/cveId"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/containers/cna/metrics"
  },
  "source_id": "core-cve",
  "document_id": 326394,
  "published_at": "2026-10-26T16:08:52.433+00:00"
}