{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-82389 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2026-82389 yet. Limit exposure of the affected software until one is available.","what":"CVE-2026-82389 is a medium-severity vulnerability in zephyrproject zephyr, published on 26 Oct 2026."},"fix_prompt":"Check this codebase for CVE-2026-82389 and fix it if it is affected.\n\nWhat it is: CVE-2026-82389 is a medium-severity vulnerability in zephyrproject zephyr, published on 26 Oct 2026. \nExploitation: There is no known exploitation of CVE-2026-82389 in the wild and no public exploit code.\n\nAffected product: zephyrproject zephyr. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-82389/ (Markdown: https://insights.sbomify.com/CVE-2026-82389/index.md)","id":"CVE-2026-82389","markdown":"https://insights.sbomify.com/CVE-2026-82389/index.md","name":"CVE-2026-82389","record":{"aliases":["GHSA-rrqj-542q-26jm","UBUNTU-CVE-2026-82389"],"analysis":null,"analysis_generated_by":null,"assigner":"zephyr","cpe":[],"cvss":{"score":6.5,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[{"id":"CWE-476","name":"NULL Pointer Dereference"}],"description":"In the Bluetooth Classic Hands-Free Profile Audio Gateway role, hfp_ag_create() in subsys/bluetooth/host/classic/hfp_ag.c starts an SDP discovery toward the peer, which links the embedded ag-\u003esdp_param._node into the SDP client's pending request list in subsys/bluetooth/host/classic/sdp.c. If the subsequent bt_rfcomm_dlc_connect() call fails, bt_hfp_ag_connect() cleaned up by memset()-ing the entire AG object while that node was still linked, and while ag-\u003eslc_work could still be queued on the system work queue. An in-flight SDP discovery cannot be cancelled — bt_sdp_discover_cancel() is declared in the public header but has no implementation — so the request stays in the list with its func, pool and uuid pointers zeroed.\n\nThe RFCOMM channel passed to bt_hfp_ag_connect() is taken from the peer's own SDP Hands-Free service record in the normal AG flow (bt_sdp_get_proto_param() performs no range validation, and samples/bluetooth/classic/handsfree_ag feeds the value straight through), so a remote BR/EDR device in radio range that advertises an RFCOMM channel outside the valid range 0x01..0x1e deterministically forces bt_rfcomm_dlc_connect() to fail and reach the wipe. Reading the peer's SDP record requires no pairing, and the peer can also trigger the failure by dropping the ACL or racing an RFCOMM DLC on the same DLCI at the right moment.\n\nWhen the SDP client next advances its request list, sdp_client_discover() dereferences the zeroed parameters — net_buf_alloc(param-\u003epool, …) with a NULL pool and param-\u003euuid-\u003etype — and the result-notification paths call through the NULL params-\u003efunc. Zeroing a linked node also truncates the request list behind a stale tail pointer, and re-arming the freed AG slot re-appends the same node and can produce a self-looping list that hangs the Bluetooth RX thread. The impact is a crash or hang of the Bluetooth stack; the written value is a constant zero at a fixed static address, so no attacker-controlled write is available.\n\nOnly builds with CONFIG_BT_CLASSIC and CONFIG_BT_HFP_AG that use the Audio Gateway role are affected.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":false,"headline":"In the Bluetooth Classic Hands-Free Profile Audio Gateway role, hfp_ag_create() in subsys/bluetooth/host/classic/hfp_ag.c starts an SDP disc","id":"CVE-2026-82389","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":null,"year":"2026"},"n_packages":0,"n_references":2,"next":{"headline":"Cross-session AES key confusion in the Espressif ESP32 hardware crypto driver","id":"CVE-2026-82390"},"packages":[],"prev":{"headline":"Use of a released HFP HF object after a failed RFCOMM connect in the Bluetooth Classic host","id":"CVE-2026-82388"},"products":["zephyr"],"published":"2026-10-26","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-10-26","vendors":["zephyrproject"]},"summary":null,"url":"https://insights.sbomify.com/CVE-2026-82389/"}