{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-19940 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2026-19940 yet. Limit exposure of the affected software until one is available.","what":"CVE-2026-19940 is a medium-severity use after free vulnerability in zephyrproject zephyr, published on 13 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-19940 and fix it if it is affected.\n\nWhat it is: CVE-2026-19940 is a medium-severity use after free vulnerability in zephyrproject zephyr, published on 13 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-19940 in the wild and no public exploit code.\n\nAffected product: zephyrproject zephyr. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-19940/ (Markdown: https://insights.sbomify.com/CVE-2026-19940/index.md)","id":"CVE-2026-19940","markdown":"https://insights.sbomify.com/CVE-2026-19940/index.md","name":"CVE-2026-19940","record":{"aliases":["GHSA-v47w-8959-rx62"],"analysis":{"component_type":"operating_system","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Zephyr RTOS","requires_auth":"none","summary":"A remote attacker can cause a system-wide denial of service in Zephyr RTOS by triggering a use-after-free in the Bluetooth HFP Audio Gateway during connection teardown and re-establishment.","user_interaction":"not_required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"zephyr","cpe":[],"cvss":{"score":6.5,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[{"id":"CWE-416","name":"Use After Free"}],"description":"The Bluetooth Classic Hands-Free Profile Audio Gateway implementation in subsys/bluetooth/host/classic/hfp_ag.c keeps its struct bt_hfp_ag objects in a static pool indexed by ACL connection index. On link teardown, hfp_ag_disconnected() cancels ag-\u003etx_work and the per-call work items and then clears ag-\u003eacl_conn, which marks the pool slot as free — but it leaves ag-\u003eongoing_call_work (and ag-\u003eslc_work) untouched. The next connection that lands on the same slot enters hfp_ag_create(), whose only occupancy test is ag-\u003eacl_conn, and immediately executes memset(ag, 0, sizeof(struct bt_hfp_ag)) followed by k_work_init_delayable(). Zeroing and re-initialising a k_work_delayable whose struct _timeout node is still linked into the kernel timeout list leaves the kernel holding a reference to a node with NULL prev/next links.\n\nag-\u003eongoing_call_work is armed by the remote peer: when a Hands-Free unit sends AT+CIND? during Service Level Connection establishment and the application provides the asynchronous get_ongoing_call callback, the AG schedules the work for CONFIG_BT_HFP_AG_GET_ONGOING_CALL_TIMEOUT milliseconds (default 10000). The timer is cancelled only if the application answers in time via bt_hfp_ag_ongoing_calls(). A peer that sends AT+CIND?, then disconnects the HFP RFCOMM DLC, then immediately re-opens it on the same ACL link, reuses the same pool slot deterministically while the timeout is still pending — the AG's RFCOMM server accept path (hfp_ag_accept()) calls hfp_ag_create() directly, so the remote side drives both teardown and re-creation.\n\nThe result is corruption of the kernel's timeout list: sys_dlist_remove() on the zeroed node performs writes through NULL pointers from the clock-announce path, and rescheduling the re-initialised work re-inserts a node the list already references, creating a cycle that the announce loop walks with interrupts locked. The observable impact is a fault or hang of the whole system, i.e. a denial of service reachable from Bluetooth radio range; no attacker-controlled data is written, so this does not by itself yield code execution. Exposure is limited to builds with CONFIG_BT_HFP_AG (marked experimental and disabled by default) whose application implements the asynchronous get_ongoing_call callback.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":false,"headline":"Use after free in zephyr","id":"CVE-2026-19940","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"use_after_free","year":"2026"},"n_packages":0,"n_references":2,"next":{"headline":"checkwildcard() accepts an out-of-zone NSEC as a wildcard-nonexistence proof","id":"CVE-2026-19941"},"packages":[],"prev":{"headline":"Bluetooth Classic AVDTP: stale timeout work on signalling-channel disconnect leads to kernel timeout-list corruption","id":"CVE-2026-19939"},"products":["zephyr"],"published":"2026-10-13","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-10-14","vendors":["zephyrproject"]},"summary":"A remote attacker can cause a system-wide denial of service in Zephyr RTOS by triggering a use-after-free in the Bluetooth HFP Audio Gateway during connection teardown and re-establishment.","url":"https://insights.sbomify.com/CVE-2026-19940/"}