Vulnerability-Lookup

CVE-2026-82388 (GCVE-0-2026-82388)

Vulnerability from cvelistv5 – Published: 2026-10-26 16:08 – Updated: 2026-10-26 17:37

Title

Use of a released HFP HF object after a failed RFCOMM connect in the Bluetooth Classic host

Summary

bt_hfp_hf_connect() in subsys/bluetooth/host/classic/hfp_hf.c allocates the per-connection HFP Hands-Free object with hfp_hf_create(), which starts an SDP discovery by passing the object's embedded hf->sdp_param to bt_sdp_discover(). That call links the caller-owned parameter block into the SDP client's request list (session->reqs in subsys/bluetooth/host/classic/sdp.c). If the subsequent bt_rfcomm_dlc_connect() then failed, the affected code wiped the entire object with (void)memset(new_hf, 0, sizeof(*new_hf)) while that discovery was still outstanding, zeroing the sys_snode_t _node that is still linked in the SDP client's list along with the request's func, uuid and pool pointers, and zeroing the hf->slc_work work item that may already be queued on the system workqueue. The discovery could not be retracted instead: bt_sdp_discover_cancel() is declared in include/zephyr/bluetooth/classic/sdp.h but has no implementation. The failing branch is reachable with peer-supplied input. The documented use of bt_hfp_hf_connect() is to pass the RFCOMM channel read out of the remote Audio Gateway's SDP record; neither bt_sdp_get_proto_param() nor bt_hfp_hf_connect() range-checks that value, so a remote device advertising an HFP AG record with an RFCOMM channel outside 1-30 makes bt_rfcomm_dlc_connect() return -EINVAL and drives the local device into the wipe. The same branch is reached without any application misuse when the remote peer controls connection timing, for example when the RFCOMM session is in BT_RFCOMM_STATE_DISCONNECTING or the ACL is dropped between object creation and the RFCOMM call. Once the object has been wiped, the Bluetooth host continues to use it: sdp_client_alloc_buf() dereferences session->param->pool, which is now NULL, and the SDP receive paths call session->param->func() through a null function pointer, neither of which is NULL-checked. Because the wipe also clears hf->acl, the pool slot is considered free and a retry or an incoming HFP connection re-appends the same still-linked list node, turning session->reqs into a self-referential list that the host's list walkers never leave. The result is a fault or an unrecoverable hang in the Bluetooth host thread; the stray indirect call is through an all-zero pointer whose target the attacker does not control, so the practical impact is denial of service. The fix keeps the object allocated and marks it with a new BT_HFP_HF_FLAG_RELEASING flag, letting bt_hfp_hf_discover_cb() release it once the discovery completes instead of destroying it under the SDP client. Only builds with CONFIG_BT_CLASSIC and CONFIG_BT_HFP_HF enabled are affected.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-26 16:49 UTC

CWE

CWE-416 - use-after-free

Assigner

zephyr CNA under the mitre root

CNA scorecard B 77/100 over 202 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/zephyrproject-rtos/zephyr/comm…	patch
https://github.com/zephyrproject-rtos/zephyr/secu…

Impacted products

1 product

Vendor	Product	Version	CPE status
zephyrproject	zephyr	Affected: 4.4.0 , < 4.5.0 (semver)	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-82388",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-26T16:49:39.950513Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-26T17:37:10.831Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/zephyrproject-rtos/zephyr",
          "defaultStatus": "unaffected",
          "packageName": "zephyr",
          "product": "zephyr",
          "programFiles": [
            "subsys/bluetooth/host/classic/hfp_hf.c",
            "subsys/bluetooth/host/classic/hfp_hf_internal.h"
          ],
          "programRoutines": [
            {
              "name": "bt_hfp_hf_connect"
            },
            {
              "name": "hfp_hf_create"
            }
          ],
          "vendor": "zephyrproject",
          "versions": [
            {
              "lessThan": "4.5.0",
              "status": "affected",
              "version": "4.4.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "bt_hfp_hf_connect() in subsys/bluetooth/host/classic/hfp_hf.c allocates the per-connection HFP Hands-Free object with hfp_hf_create(), which starts an SDP discovery by passing the object\u0027s embedded hf-\u003esdp_param to bt_sdp_discover(). That call links the caller-owned parameter block into the SDP client\u0027s request list (session-\u003ereqs in subsys/bluetooth/host/classic/sdp.c). If the subsequent bt_rfcomm_dlc_connect() then failed, the affected code wiped the entire object with (void)memset(new_hf, 0, sizeof(*new_hf)) while that discovery was still outstanding, zeroing the sys_snode_t _node that is still linked in the SDP client\u0027s list along with the request\u0027s func, uuid and pool pointers, and zeroing the hf-\u003eslc_work work item that may already be queued on the system workqueue. The discovery could not be retracted instead: bt_sdp_discover_cancel() is declared in include/zephyr/bluetooth/classic/sdp.h but has no implementation.\n\nThe failing branch is reachable with peer-supplied input. The documented use of bt_hfp_hf_connect() is to pass the RFCOMM channel read out of the remote Audio Gateway\u0027s SDP record; neither bt_sdp_get_proto_param() nor bt_hfp_hf_connect() range-checks that value, so a remote device advertising an HFP AG record with an RFCOMM channel outside 1-30 makes bt_rfcomm_dlc_connect() return -EINVAL and drives the local device into the wipe. The same branch is reached without any application misuse when the remote peer controls connection timing, for example when the RFCOMM session is in BT_RFCOMM_STATE_DISCONNECTING or the ACL is dropped between object creation and the RFCOMM call.\n\nOnce the object has been wiped, the Bluetooth host continues to use it: sdp_client_alloc_buf() dereferences session-\u003eparam-\u003epool, which is now NULL, and the SDP receive paths call session-\u003eparam-\u003efunc() through a null function pointer, neither of which is NULL-checked. Because the wipe also clears hf-\u003eacl, the pool slot is considered free and a retry or an incoming HFP connection re-appends the same still-linked list node, turning session-\u003ereqs into a self-referential list that the host\u0027s list walkers never leave. The result is a fault or an unrecoverable hang in the Bluetooth host thread; the stray indirect call is through an all-zero pointer whose target the attacker does not control, so the practical impact is denial of service.\n\nThe fix keeps the object allocated and marks it with a new BT_HFP_HF_FLAG_RELEASING flag, letting bt_hfp_hf_discover_cb() release it once the discovery completes instead of destroying it under the SDP client. Only builds with CONFIG_BT_CLASSIC and CONFIG_BT_HFP_HF enabled are affected."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "use-after-free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-26T16:08:52.433Z",
        "orgId": "e2e69745-5e70-4e92-8431-deb5529a81ad",
        "shortName": "zephyr"
      },
      "references": [
        {
          "name": "Fix commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/zephyrproject-rtos/zephyr/commit/6119da5d632594131304dec85000a75dc17743d2"
        },
        {
          "name": "GHSA-398x-f7rq-5jj9",
          "url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-398x-f7rq-5jj9"
        }
      ],
      "title": "Use of a released HFP HF object after a failed RFCOMM connect in the Bluetooth Classic host",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e2e69745-5e70-4e92-8431-deb5529a81ad",
    "assignerShortName": "zephyr",
    "cveId": "CVE-2026-82388",
    "datePublished": "2026-10-26T16:08:52.433Z",
    "dateReserved": "2026-08-28T21:11:40.506Z",
    "dateUpdated": "2026-10-26T17:37:10.831Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-82388",
      "date": "2026-10-28",
      "epss": "0.00209",
      "percentile": "0.11065"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "collectionURL": "https://github.com/zephyrproject-rtos/zephyr",
                "defaultStatus": "unaffected",
                "packageName": "zephyr",
                "product": "zephyr",
                "programFiles": [
                  "subsys/bluetooth/host/classic/hfp_hf.c",
                  "subsys/bluetooth/host/classic/hfp_hf_internal.h"
                ],
                "programRoutines": [
                  {
                    "name": "bt_hfp_hf_connect"
                  },
                  {
                    "name": "hfp_hf_create"
                  }
                ],
                "vendor": "zephyrproject",
                "versions": [
                  {
                    "lessThan": "4.5.0",
                    "status": "affected",
                    "version": "4.4.0",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "vulnerabilities@zephyrproject.org"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "bt_hfp_hf_connect() in subsys/bluetooth/host/classic/hfp_hf.c allocates the per-connection HFP Hands-Free object with hfp_hf_create(), which starts an SDP discovery by passing the object\u0027s embedded hf-\u003esdp_param to bt_sdp_discover(). That call links the caller-owned parameter block into the SDP client\u0027s request list (session-\u003ereqs in subsys/bluetooth/host/classic/sdp.c). If the subsequent bt_rfcomm_dlc_connect() then failed, the affected code wiped the entire object with (void)memset(new_hf, 0, sizeof(*new_hf)) while that discovery was still outstanding, zeroing the sys_snode_t _node that is still linked in the SDP client\u0027s list along with the request\u0027s func, uuid and pool pointers, and zeroing the hf-\u003eslc_work work item that may already be queued on the system workqueue. The discovery could not be retracted instead: bt_sdp_discover_cancel() is declared in include/zephyr/bluetooth/classic/sdp.h but has no implementation.\n\nThe failing branch is reachable with peer-supplied input. The documented use of bt_hfp_hf_connect() is to pass the RFCOMM channel read out of the remote Audio Gateway\u0027s SDP record; neither bt_sdp_get_proto_param() nor bt_hfp_hf_connect() range-checks that value, so a remote device advertising an HFP AG record with an RFCOMM channel outside 1-30 makes bt_rfcomm_dlc_connect() return -EINVAL and drives the local device into the wipe. The same branch is reached without any application misuse when the remote peer controls connection timing, for example when the RFCOMM session is in BT_RFCOMM_STATE_DISCONNECTING or the ACL is dropped between object creation and the RFCOMM call.\n\nOnce the object has been wiped, the Bluetooth host continues to use it: sdp_client_alloc_buf() dereferences session-\u003eparam-\u003epool, which is now NULL, and the SDP receive paths call session-\u003eparam-\u003efunc() through a null function pointer, neither of which is NULL-checked. Because the wipe also clears hf-\u003eacl, the pool slot is considered free and a retry or an incoming HFP connection re-appends the same still-linked list node, turning session-\u003ereqs into a self-referential list that the host\u0027s list walkers never leave. The result is a fault or an unrecoverable hang in the Bluetooth host thread; the stray indirect call is through an all-zero pointer whose target the attacker does not control, so the practical impact is denial of service.\n\nThe fix keeps the object allocated and marks it with a new BT_HFP_HF_FLAG_RELEASING flag, letting bt_hfp_hf_discover_cb() release it once the discovery completes instead of destroying it under the SDP client. Only builds with CONFIG_BT_CLASSIC and CONFIG_BT_HFP_HF enabled are affected."
          }
        ],
        "id": "CVE-2026-82388",
        "lastModified": "2026-10-26T18:34:17.050",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.6,
              "impactScore": 3.6,
              "source": "vulnerabilities@zephyrproject.org",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-82388",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-26T16:49:39.950513Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-10-26T17:17:30.620",
        "references": [
          {
            "source": "vulnerabilities@zephyrproject.org",
            "url": "https://github.com/zephyrproject-rtos/zephyr/commit/6119da5d632594131304dec85000a75dc17743d2"
          },
          {
            "source": "vulnerabilities@zephyrproject.org",
            "url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-398x-f7rq-5jj9"
          }
        ],
        "sourceIdentifier": "vulnerabilities@zephyrproject.org",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "vulnerabilities@zephyrproject.org",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-82388",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-10-26T16:49:39.950513Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-10-26T17:35:28.811Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://github.com/zephyrproject-rtos/zephyr",
              "defaultStatus": "unaffected",
              "packageName": "zephyr",
              "product": "zephyr",
              "programFiles": [
                "subsys/bluetooth/host/classic/hfp_hf.c",
                "subsys/bluetooth/host/classic/hfp_hf_internal.h"
              ],
              "programRoutines": [
                {
                  "name": "bt_hfp_hf_connect"
                },
                {
                  "name": "hfp_hf_create"
                }
              ],
              "vendor": "zephyrproject",
              "versions": [
                {
                  "lessThan": "4.5.0",
                  "status": "affected",
                  "version": "4.4.0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "bt_hfp_hf_connect() in subsys/bluetooth/host/classic/hfp_hf.c allocates the per-connection HFP Hands-Free object with hfp_hf_create(), which starts an SDP discovery by passing the object\u0027s embedded hf-\u003esdp_param to bt_sdp_discover(). That call links the caller-owned parameter block into the SDP client\u0027s request list (session-\u003ereqs in subsys/bluetooth/host/classic/sdp.c). If the subsequent bt_rfcomm_dlc_connect() then failed, the affected code wiped the entire object with (void)memset(new_hf, 0, sizeof(*new_hf)) while that discovery was still outstanding, zeroing the sys_snode_t _node that is still linked in the SDP client\u0027s list along with the request\u0027s func, uuid and pool pointers, and zeroing the hf-\u003eslc_work work item that may already be queued on the system workqueue. The discovery could not be retracted instead: bt_sdp_discover_cancel() is declared in include/zephyr/bluetooth/classic/sdp.h but has no implementation.\n\nThe failing branch is reachable with peer-supplied input. The documented use of bt_hfp_hf_connect() is to pass the RFCOMM channel read out of the remote Audio Gateway\u0027s SDP record; neither bt_sdp_get_proto_param() nor bt_hfp_hf_connect() range-checks that value, so a remote device advertising an HFP AG record with an RFCOMM channel outside 1-30 makes bt_rfcomm_dlc_connect() return -EINVAL and drives the local device into the wipe. The same branch is reached without any application misuse when the remote peer controls connection timing, for example when the RFCOMM session is in BT_RFCOMM_STATE_DISCONNECTING or the ACL is dropped between object creation and the RFCOMM call.\n\nOnce the object has been wiped, the Bluetooth host continues to use it: sdp_client_alloc_buf() dereferences session-\u003eparam-\u003epool, which is now NULL, and the SDP receive paths call session-\u003eparam-\u003efunc() through a null function pointer, neither of which is NULL-checked. Because the wipe also clears hf-\u003eacl, the pool slot is considered free and a retry or an incoming HFP connection re-appends the same still-linked list node, turning session-\u003ereqs into a self-referential list that the host\u0027s list walkers never leave. The result is a fault or an unrecoverable hang in the Bluetooth host thread; the stray indirect call is through an all-zero pointer whose target the attacker does not control, so the practical impact is denial of service.\n\nThe fix keeps the object allocated and marks it with a new BT_HFP_HF_FLAG_RELEASING flag, letting bt_hfp_hf_discover_cb() release it once the discovery completes instead of destroying it under the SDP client. Only builds with CONFIG_BT_CLASSIC and CONFIG_BT_HFP_HF enabled are affected."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "format": "CVSS"
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-416",
                  "description": "use-after-free",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-10-26T16:08:52.433Z",
            "orgId": "e2e69745-5e70-4e92-8431-deb5529a81ad",
            "shortName": "zephyr"
          },
          "references": [
            {
              "name": "Fix commit",
              "tags": [
                "patch"
              ],
              "url": "https://github.com/zephyrproject-rtos/zephyr/commit/6119da5d632594131304dec85000a75dc17743d2"
            },
            {
              "name": "GHSA-398x-f7rq-5jj9",
              "url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-398x-f7rq-5jj9"
            }
          ],
          "title": "Use of a released HFP HF object after a failed RFCOMM connect in the Bluetooth Classic host",
          "x_generator": {
            "engine": "cvelib 1.8.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "e2e69745-5e70-4e92-8431-deb5529a81ad",
        "assignerShortName": "zephyr",
        "cveId": "CVE-2026-82388",
        "datePublished": "2026-10-26T16:08:52.433Z",
        "dateReserved": "2026-08-28T21:11:40.506Z",
        "dateUpdated": "2026-10-26T17:37:10.831Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-82388

Vulnerability from fkie_nvd - Published: 2026-10-26 17:17 - Updated: 2026-10-26 18:34

Severity

5.3 (Medium) - CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

References

	URL	Tags
	vulnerabilities@zephyrproject.org	https://github.com/zephyrproject-rtos/zephyr/commit/6119da5d632594131304dec85000a75dc17743d2
	vulnerabilities@zephyrproject.org	https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-398x-f7rq-5jj9

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://github.com/zephyrproject-rtos/zephyr",
          "defaultStatus": "unaffected",
          "packageName": "zephyr",
          "product": "zephyr",
          "programFiles": [
            "subsys/bluetooth/host/classic/hfp_hf.c",
            "subsys/bluetooth/host/classic/hfp_hf_internal.h"
          ],
          "programRoutines": [
            {
              "name": "bt_hfp_hf_connect"
            },
            {
              "name": "hfp_hf_create"
            }
          ],
          "vendor": "zephyrproject",
          "versions": [
            {
              "lessThan": "4.5.0",
              "status": "affected",
              "version": "4.4.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "vulnerabilities@zephyrproject.org"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "bt_hfp_hf_connect() in subsys/bluetooth/host/classic/hfp_hf.c allocates the per-connection HFP Hands-Free object with hfp_hf_create(), which starts an SDP discovery by passing the object\u0027s embedded hf-\u003esdp_param to bt_sdp_discover(). That call links the caller-owned parameter block into the SDP client\u0027s request list (session-\u003ereqs in subsys/bluetooth/host/classic/sdp.c). If the subsequent bt_rfcomm_dlc_connect() then failed, the affected code wiped the entire object with (void)memset(new_hf, 0, sizeof(*new_hf)) while that discovery was still outstanding, zeroing the sys_snode_t _node that is still linked in the SDP client\u0027s list along with the request\u0027s func, uuid and pool pointers, and zeroing the hf-\u003eslc_work work item that may already be queued on the system workqueue. The discovery could not be retracted instead: bt_sdp_discover_cancel() is declared in include/zephyr/bluetooth/classic/sdp.h but has no implementation.\n\nThe failing branch is reachable with peer-supplied input. The documented use of bt_hfp_hf_connect() is to pass the RFCOMM channel read out of the remote Audio Gateway\u0027s SDP record; neither bt_sdp_get_proto_param() nor bt_hfp_hf_connect() range-checks that value, so a remote device advertising an HFP AG record with an RFCOMM channel outside 1-30 makes bt_rfcomm_dlc_connect() return -EINVAL and drives the local device into the wipe. The same branch is reached without any application misuse when the remote peer controls connection timing, for example when the RFCOMM session is in BT_RFCOMM_STATE_DISCONNECTING or the ACL is dropped between object creation and the RFCOMM call.\n\nOnce the object has been wiped, the Bluetooth host continues to use it: sdp_client_alloc_buf() dereferences session-\u003eparam-\u003epool, which is now NULL, and the SDP receive paths call session-\u003eparam-\u003efunc() through a null function pointer, neither of which is NULL-checked. Because the wipe also clears hf-\u003eacl, the pool slot is considered free and a retry or an incoming HFP connection re-appends the same still-linked list node, turning session-\u003ereqs into a self-referential list that the host\u0027s list walkers never leave. The result is a fault or an unrecoverable hang in the Bluetooth host thread; the stray indirect call is through an all-zero pointer whose target the attacker does not control, so the practical impact is denial of service.\n\nThe fix keeps the object allocated and marks it with a new BT_HFP_HF_FLAG_RELEASING flag, letting bt_hfp_hf_discover_cb() release it once the discovery completes instead of destroying it under the SDP client. Only builds with CONFIG_BT_CLASSIC and CONFIG_BT_HFP_HF enabled are affected."
    }
  ],
  "id": "CVE-2026-82388",
  "lastModified": "2026-10-26T18:34:17.050",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 3.6,
        "source": "vulnerabilities@zephyrproject.org",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-82388",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-10-26T16:49:39.950513Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-10-26T17:17:30.620",
  "references": [
    {
      "source": "vulnerabilities@zephyrproject.org",
      "url": "https://github.com/zephyrproject-rtos/zephyr/commit/6119da5d632594131304dec85000a75dc17743d2"
    },
    {
      "source": "vulnerabilities@zephyrproject.org",
      "url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-398x-f7rq-5jj9"
    }
  ],
  "sourceIdentifier": "vulnerabilities@zephyrproject.org",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-416"
        }
      ],
      "source": "vulnerabilities@zephyrproject.org",
      "type": "Secondary"
    }
  ]
}

UBUNTU-CVE-2026-82388 (CVE-2026-82388)

Vulnerability from osv_ubuntu – Published: 2026-10-27 00:00 – Updated: 2026-10-27 00:00 – Source website

Details

Severity

5.3 (Medium)


                    
                      CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-82388	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-82388	REPORT
	https://github.com/zephyrproject-rtos/zephyr	REPORT
	https://github.com/cveproject/cvelistv5/tree/main…	REPORT
	https://github.com/zephyrproject-rtos/zephyr/comm…	REPORT
	https://github.com/zephyrproject-rtos/zephyr/secu…	REPORT
	https://nvd.nist.gov/vuln/detail/cve-2026-82388	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libzephyr4",
            "binary_version": "3.1.2-1build1"
          },
          {
            "binary_name": "libzephyr4-krb5",
            "binary_version": "3.1.2-1build1"
          },
          {
            "binary_name": "zephyr-clients",
            "binary_version": "3.1.2-1build1"
          },
          {
            "binary_name": "zephyr-server",
            "binary_version": "3.1.2-1build1"
          },
          {
            "binary_name": "zephyr-server-krb5",
            "binary_version": "3.1.2-1build1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "zephyr",
        "purl": "pkg:deb/ubuntu/zephyr@3.1.2-1build1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.1.2-1",
        "3.1.2-1build1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libzephyr4",
            "binary_version": "3.1.2-1build2"
          },
          {
            "binary_name": "libzephyr4-krb5",
            "binary_version": "3.1.2-1build2"
          },
          {
            "binary_name": "zephyr-clients",
            "binary_version": "3.1.2-1build2"
          },
          {
            "binary_name": "zephyr-server",
            "binary_version": "3.1.2-1build2"
          },
          {
            "binary_name": "zephyr-server-krb5",
            "binary_version": "3.1.2-1build2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "zephyr",
        "purl": "pkg:deb/ubuntu/zephyr@3.1.2-1build2?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.1.2-1build1",
        "3.1.2-1build2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libzephyr4",
            "binary_version": "3.1.2-1build3"
          },
          {
            "binary_name": "libzephyr4-krb5",
            "binary_version": "3.1.2-1build3"
          },
          {
            "binary_name": "zephyr-clients",
            "binary_version": "3.1.2-1build3"
          },
          {
            "binary_name": "zephyr-server",
            "binary_version": "3.1.2-1build3"
          },
          {
            "binary_name": "zephyr-server-krb5",
            "binary_version": "3.1.2-1build3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "zephyr",
        "purl": "pkg:deb/ubuntu/zephyr@3.1.2-1build3?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.1.2-1build3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libzephyr4",
            "binary_version": "3.1.2-1build3"
          },
          {
            "binary_name": "libzephyr4-krb5",
            "binary_version": "3.1.2-1build3"
          },
          {
            "binary_name": "zephyr-clients",
            "binary_version": "3.1.2-1build3"
          },
          {
            "binary_name": "zephyr-server",
            "binary_version": "3.1.2-1build3"
          },
          {
            "binary_name": "zephyr-server-krb5",
            "binary_version": "3.1.2-1build3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "zephyr",
        "purl": "pkg:deb/ubuntu/zephyr@3.1.2-1build3?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.1.2-1build3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libzephyr4",
            "binary_version": "3.1.2-1.1build1"
          },
          {
            "binary_name": "libzephyr4-krb5",
            "binary_version": "3.1.2-1.1build1"
          },
          {
            "binary_name": "zephyr-clients",
            "binary_version": "3.1.2-1.1build1"
          },
          {
            "binary_name": "zephyr-server",
            "binary_version": "3.1.2-1.1build1"
          },
          {
            "binary_name": "zephyr-server-krb5",
            "binary_version": "3.1.2-1.1build1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "zephyr",
        "purl": "pkg:deb/ubuntu/zephyr@3.1.2-1.1build1?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.1.2-1.1",
        "3.1.2-1.1build1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libzephyr4",
            "binary_version": "3.1.2-4"
          },
          {
            "binary_name": "libzephyr4-krb5",
            "binary_version": "3.1.2-4"
          },
          {
            "binary_name": "zephyr-clients",
            "binary_version": "3.1.2-4"
          },
          {
            "binary_name": "zephyr-server",
            "binary_version": "3.1.2-4"
          },
          {
            "binary_name": "zephyr-server-krb5",
            "binary_version": "3.1.2-4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.10",
        "name": "zephyr",
        "purl": "pkg:deb/ubuntu/zephyr@3.1.2-4?arch=source\u0026distro=stonking"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.1.2-4"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libzephyr4",
            "binary_version": "3.1.2-4"
          },
          {
            "binary_name": "libzephyr4-krb5",
            "binary_version": "3.1.2-4"
          },
          {
            "binary_name": "zephyr-clients",
            "binary_version": "3.1.2-4"
          },
          {
            "binary_name": "zephyr-server",
            "binary_version": "3.1.2-4"
          },
          {
            "binary_name": "zephyr-server-krb5",
            "binary_version": "3.1.2-4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "zephyr",
        "purl": "pkg:deb/ubuntu/zephyr@3.1.2-4?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.1.2-1.1build1",
        "3.1.2-4"
      ]
    }
  ],
  "aliases": [],
  "details": "bt_hfp_hf_connect() in subsys/bluetooth/host/classic/hfp_hf.c allocates the per-connection HFP Hands-Free object with hfp_hf_create(), which starts an SDP discovery by passing the object\u0027s embedded hf-\u003esdp_param to bt_sdp_discover(). That call links the caller-owned parameter block into the SDP client\u0027s request list (session-\u003ereqs in subsys/bluetooth/host/classic/sdp.c). If the subsequent bt_rfcomm_dlc_connect() then failed, the affected code wiped the entire object with (void)memset(new_hf, 0, sizeof(*new_hf)) while that discovery was still outstanding, zeroing the sys_snode_t _node that is still linked in the SDP client\u0027s list along with the request\u0027s func, uuid and pool pointers, and zeroing the hf-\u003eslc_work work item that may already be queued on the system workqueue. The discovery could not be retracted instead: bt_sdp_discover_cancel() is declared in include/zephyr/bluetooth/classic/sdp.h but has no implementation. The failing branch is reachable with peer-supplied input. The documented use of bt_hfp_hf_connect() is to pass the RFCOMM channel read out of the remote Audio Gateway\u0027s SDP record; neither bt_sdp_get_proto_param() nor bt_hfp_hf_connect() range-checks that value, so a remote device advertising an HFP AG record with an RFCOMM channel outside 1-30 makes bt_rfcomm_dlc_connect() return -EINVAL and drives the local device into the wipe. The same branch is reached without any application misuse when the remote peer controls connection timing, for example when the RFCOMM session is in BT_RFCOMM_STATE_DISCONNECTING or the ACL is dropped between object creation and the RFCOMM call. Once the object has been wiped, the Bluetooth host continues to use it: sdp_client_alloc_buf() dereferences session-\u003eparam-\u003epool, which is now NULL, and the SDP receive paths call session-\u003eparam-\u003efunc() through a null function pointer, neither of which is NULL-checked. Because the wipe also clears hf-\u003eacl, the pool slot is considered free and a retry or an incoming HFP connection re-appends the same still-linked list node, turning session-\u003ereqs into a self-referential list that the host\u0027s list walkers never leave. The result is a fault or an unrecoverable hang in the Bluetooth host thread; the stray indirect call is through an all-zero pointer whose target the attacker does not control, so the practical impact is denial of service. The fix keeps the object allocated and marks it with a new BT_HFP_HF_FLAG_RELEASING flag, letting bt_hfp_hf_discover_cb() release it once the discovery completes instead of destroying it under the SDP client. Only builds with CONFIG_BT_CLASSIC and CONFIG_BT_HFP_HF enabled are affected.",
  "id": "UBUNTU-CVE-2026-82388",
  "modified": "2026-10-27T00:00:00Z",
  "published": "2026-10-27T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-82388"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-82388"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/zephyrproject-rtos/zephyr"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/cveproject/cvelistv5/tree/main/cves/2026/82xxx/cve-2026-82388.json"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/zephyrproject-rtos/zephyr/commit/6119da5d632594131304dec85000a75dc17743d2"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/ghsa-398x-f7rq-5jj9"
    },
    {
      "type": "REPORT",
      "url": "https://nvd.nist.gov/vuln/detail/cve-2026-82388"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-82388"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-82388 (GCVE-0-2026-82388)

FKIE_CVE-2026-82388

UBUNTU-CVE-2026-82388 (CVE-2026-82388)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour