Is CVE-2026-19940 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-19940 being exploited in the wild.

How severe is CVE-2026-19940?

Medium severity, with a CVSS score of 6.5, published 13 October 2026.

Which products and versions are affected?

Zephyr Project Zephyr RTOS Versions with CONFIG_BT_HFP_AG enabled.

How is CVE-2026-19940 attacked?

It is attacked from the adjacent network, in an operating system.

Am I affected by CVE-2026-19940?

Check whether you run Zephyr Project Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-19940: Zephyr RTOS Bluetooth HFP AG work queue memory corruption

CVE-2026-19940 · Severity: medium · CVSS 6.5 · Published 2026-10-13

The Bluetooth Hands-Free Profile Audio Gateway implementation in Zephyr RTOS contains a memory corruption vulnerability in its work queue management. An attacker within Bluetooth range can trigger a system crash or hang by repeatedly connecting and disconnecting a Hands-Free device on the same ACL link, exploiting a race condition in the connection pool reuse logic.

Technologies: Zephyr Project Zephyr RTOS. Vendors: Zephyr Project.

Quick answers

Is CVE-2026-19940 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-19940 being exploited in the wild.
How severe is CVE-2026-19940?: Medium severity, with a CVSS score of 6.5, published 13 October 2026.
Which products and versions are affected?: Zephyr Project Zephyr RTOS Versions with CONFIG_BT_HFP_AG enabled.
Is there a fix for CVE-2026-19940?: No fixed version is recorded yet. Disable CONFIG_BT_HFP_AG unless the Hands-Free Profile Audio Gateway role is required, or do not implement the asynchronous get_ongoing_call callback to avoid scheduling the vulnerable work structure.</anigation> </invoke> If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-19940 attacked?: It is attacked from the adjacent network, in an operating system.
Am I affected by CVE-2026-19940?: Check whether you run Zephyr Project Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Disable CONFIG_BT_HFP_AG unless the Hands-Free Profile Audio Gateway role is required, or do not implement the asynchronous get_ongoing_call callback to avoid scheduling the vulnerable work structure.</anigation> </invoke>

Technical details

The vulnerability occurs in subsys/bluetooth/host/classic/hfp_ag.c where disconnection fails to cancel pending ag->ongoing_call_work before the connection pool slot is marked free and reused. When a new connection reuses the same slot, hfp_ag_create() zeroes and re-initializes the work structure while the kernel's timeout list still references it, corrupting the timeout list's internal links. A remote peer can deterministically trigger this by sending AT+CIND?, disconnecting the RFCOMM DLC, and immediately reconnecting on the same ACL link before the timeout expires, causing NULL pointer dereferences or list cycles in the kernel's clock announcement path.

Affected products

Zephyr Project Zephyr RTOS Versions with CONFIG_BT_HFP_AG enabled

Timeline

2026-10-13: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.