CVE-2026-77684: dos in zephyrproject zephyr

The vulnerability in Zephyr's Bluetooth Classic HFP HF role arises from failure to release AT command buffers queued on hf->tx_pending when the RFCOMM DLC disconnects. The hfp_hf_disconnected() function cancels work items and clears hf->acl but does not dequeue these buffers, causing them to be lost from the fixed-size hf_pool. An unsolicited +BCS: 1 response triggers queuing of an AT+BCS buffer that cannot be transmitted due to BT_HFP_HF_FLAG_RX_ONGOING being set, and an immediate RFCOMM disconnect strands the buffer. Repeated connect/+BCS/disconnect cycles exhaust the hf_pool, causing permanent HFP command sending failure. Further, hfp_hf_send_cmd() allocates buffers with K_FOREVER from the Bluetooth RX context, which can park the Bluetooth RX thread indefinitely, halting HCI event processing until reboot. Additionally, reusing the HF slot while work handlers are still queued or running allows memset() to wipe live k_work items, corrupting kernel workqueue state. Exploitation requires an established HFP session and a build with CONFIG_BT_HFP_HF enabled.

Successful exploitation results in denial of service by exhausting the fixed buffer pool, causing permanent failure of HFP command sending. The Bluetooth RX thread can be parked indefinitely, halting all HCI event processing and requiring a device reboot. Kernel workqueue state corruption is also possible, potentially destabilizing the system. There is no impact on confidentiality or integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid enabling or using the Bluetooth Classic Hands-Free Profile HF role (CONFIG_BT_HFP_HF) in affected Zephyr versions. Monitor vendor communications for patches or official fixes.