CVE-2026-82389: Zephyr Bluetooth Classic HFP AG stack crash on RFCOMM connection failure

CVE-2026-82389 · Severity: medium · CVSS 6.5 · Published 2026-10-26

Zephyr's Bluetooth stack includes a Hands-Free Profile Audio Gateway role used in audio devices. When a remote Bluetooth device triggers a connection failure by advertising invalid channel parameters or dropping the connection at the right moment, the stack improperly clears internal state while cleanup is still pending, leading to null pointer dereferences and potential crashes or hangs of the entire Bluetooth subsystem.

Technologies: Zephyr OS. Vendors: Zephyr.

Quick answers

Is CVE-2026-82389 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-82389 being exploited in the wild.
How severe is CVE-2026-82389?
Medium severity, with a CVSS score of 6.5, published 26 October 2026.
Which products and versions are affected?
Zephyr OS Builds with CONFIG_BT_CLASSIC and CONFIG_BT_HFP_AG enabled.
Is there a fix for CVE-2026-82389?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-82389 attacked?
It is attacked over the network or from the adjacent network, in a software library.
Am I affected by CVE-2026-82389?
Check whether you run Zephyr OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a use-after-free / null pointer dereference in the SDP (Service Discovery Protocol) client handler. When bt_hfp_ag_connect() fails after bt_rfcomm_dlc_connect() returns an error, the code memset()s the AG object while its sdp_param._node is still linked in the SDP pending request list and ag->slc_work may be queued. Since bt_sdp_discover_cancel() lacks implementation, the stale request remains in the list with zeroed func, pool, and uuid pointers. A remote unpaired BR/EDR device can force the failure by advertising an out-of-range RFCOMM channel number (outside 0x01..0x1e) in its SDP service record, triggering deterministic dereferencing of the NULL pointers when SDP processing resumes.

Affected products

  • Zephyr Zephyr OS Builds with CONFIG_BT_CLASSIC and CONFIG_BT_HFP_AG enabled

Timeline

  • 2026-10-26: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.