{"schema":"threatline.record/2","record":{"id":"CVE-2026-19940","aliases":["GHSA-v47w-8959-rx62"],"summary":"Bluetooth HFP AG reuses a connection slot while a delayable work item is still armed, corrupting kernel timeout bookkeeping","details":"The Bluetooth Classic Hands-Free Profile Audio Gateway implementation in subsys/bluetooth/host/classic/hfp_ag.c keeps its struct bt_hfp_ag objects in a static pool indexed by ACL connection index. On link teardown, hfp_ag_disconnected() cancels ag->tx_work and the per-call work items and then clears ag->acl_conn, which marks the pool slot as free — but it leaves ag->ongoing_call_work (and ag->slc_work) untouched. The next connection that lands on the same slot enters hfp_ag_create(), whose only occupancy test is ag->acl_conn, and immediately executes memset(ag, 0, sizeof(struct bt_hfp_ag)) followed by k_work_init_delayable(). Zeroing and re-initialising a k_work_delayable whose struct _timeout node is still linked into the kernel timeout list leaves the kernel holding a reference to a node with NULL prev/next links.\n\nag->ongoing_call_work is armed by the remote peer: when a Hands-Free unit sends AT+CIND? during Service Level Connection establishment and the application provides the asynchronous get_ongoing_call callback, the AG schedules the work for CONFIG_BT_HFP_AG_GET_ONGOING_CALL_TIMEOUT milliseconds (default 10000). The timer is cancelled only if the application answers in time via bt_hfp_ag_ongoing_calls(). A peer that sends AT+CIND?, then disconnects the HFP RFCOMM DLC, then immediately re-opens it on the same ACL link, reuses the same pool slot deterministically while the timeout is still pending — the AG's RFCOMM server accept path (hfp_ag_accept()) calls hfp_ag_create() directly, so the remote side drives both teardown and re-creation.\n\nThe result is corruption of the kernel's timeout list: sys_dlist_remove() on the zeroed node performs writes through NULL pointers from the clock-announce path, and rescheduling the re-initialised work re-inserts a node the list already references, creating a cycle that the announce loop walks with interrupts locked. The observable impact is a fault or hang of the whole system, i.e. a denial of service reachable from Bluetooth radio range; no attacker-controlled data is written, so this does not by itself yield code execution. Exposure is limited to builds with CONFIG_BT_HFP_AG (marked experimental and disabled by default) whose application implements the asynchronous get_ongoing_call callback.","categories":["Unclassified"],"product":"zephyr","vendor":"zephyrproject","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-19940","source_modified_at":"2026-10-14T19:26:59.593Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"zephyr","vendor":"zephyrproject","versions":[{"version":"4.2.0","status":"affected","versionType":"semver","lessThanOrEqual":"4.4.2"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":6.5,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00189,"percentile":0.08149,"score_date":"2026-10-23"},"published_at":"2026-10-13T16:40:10.541Z","modified_at":"2026-10-14T19:26:59.593Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-19940","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-14T19:26:59.593Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-19940","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/zephyrproject-rtos/zephyr/commit/204c36b896fe8d68ca3cb3d00216f245f91d14be","tags":["patch"]},{"source":"CVE List","url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-v47w-8959-rx62"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-14T19:26:45.572487Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-14T19:26:59.593Z","content_hash":"f658dbcd51c73e1804c6a954e643737cac988a35ec62198d16ff4e8218512346"}}