Zephyr RTOS CVE-2026-19940

Exploitation requires the device to be built with CONFIG_BT_HFP_AG enabled (a profile the Zephyr project marks experimental and ships DISABLED by default) AND the application must implement the asynchronous get_ongoing_call callback, which is what schedules the vulnerable ag->ongoing_call_work timer (default CONFIG_BT_HFP_AG_GET_ONGOING_CALL_TIMEOUT 10000 ms). The attacker must be within Bluetooth radio range (AV:A) acting as a Hands-Free unit, and must send AT+CIND? during SLC establishment, then tear down and re-open the HFP RFCOMM DLC on the same ACL link within the ~10-second window before the application answers via bt_hfp_ag_ongoing_calls(); the same connection-index pool slot is reused deterministically, so no race-winning luck is needed. Limiting factors: experimental non-default profile, dependency on the optional callback being implemented, and physical Bluetooth proximity - these sharply reduce the exposed population below what the 6.5 score alone implies.

This is a genuine but conditional denial-of-service, not a top-tier priority. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 6.5) correctly reflects an adjacent-network (Bluetooth radio range) attack with low complexity, no privileges, and no user interaction, where the only impact is availability (A:H) - consistent with the description's conclusion that no attacker-controlled data is written and code execution is not achievable. There is no CISA KEV listing and no public exploit identified at time of analysis, so exploitation status is theoretical despite a working vendor-confirmed root-cause analysis and patch. The dominant risk-limiting signal overrides the CVSS score: the vulnerable code path exists only in builds with CONFIG_BT_HFP_AG, which the project marks experimental and ships disabled by default, AND only when the application implements the asynchronous get_ongoing_call callback. The 'RCE' tag in the input directly contradicts the description and should be disregarded - this is a CWE-416 use-after-free that manifests as kernel timeout-list corruption (NULL-pointer writes / list cycle walked with interrupts locked), yielding a hang/fault, not memory corruption an attacker can steer. Net: a real, radio-reachable DoS for the narrow set of devices that both enable an experimental profile and wire up the optional callback, but low real-world exposure for the Zephyr population at large.

An attacker within Bluetooth radio range of a Zephyr device acting as a Hands-Free Profile Audio Gateway sends AT+CIND? during Service Level Connection setup, causing the AG to arm a 10-second get_ongoing_call timer, then disconnects the HFP RFCOMM DLC and immediately re-opens it on the same ACL link before the timer fires. The re-creation path zeroes and re-initialises a k_work_delayable whose timeout node is still linked in the kernel list, corrupting it and faulting or hanging the entire system. No public exploit code is identified at time of analysis, but the vendor advisory describes a deterministic, remotely-driven trigger sequence.