GHSA-hc6x-8gm2-2r9v: Bluetooth Classic HFP Hands-Free: TX buffer leak on RFCOMM disconnect leads to permanent Bluetooth denial of service

The Bluetooth Classic Hands-Free Profile HF role in subsys/bluetooth/host/classic/hfphf.c does not release the AT command buffers that are still queued on hf->txpending when the RFCOMM DLC goes down. hfphfdisconnected() only cancelled the work items and cleared hf->acl, and no other code path ever dequeues those buffers, so each one is permanently lost from the fixed hfpool (CONFIGBTMAXCONN + 1 buffers, i.e. two in the default configuration). The same function also left BTHFPHFFLAGCONNECTED set, and hfphfcreate() wiped the object with memset() as soon as hf->acl was NULL, without checking whether hf->work, hf->slcwork or hf->deferredwork was still pending or running.

The remote Audio Gateway peer controls the trigger end to end and needs no application involvement: an unsolicited +BCS: 1 response makes bcshandle() call bthfphfselectcodec() and queue an AT+BCS buffer, which cannot be transmitted while BTHFPHFFLAGRXONGOING is set, and an immediately following RFCOMM DISC strands that buffer. Repeating the connect / +BCS / disconnect cycle a couple of times empties hfpool for good.

With the pool exhausted, HFP command sending fails permanently, and because hfphfsendcmd() allocates with KFOREVER (btrfcommcreatepdu() → btconncreatepdu()) from the Bluetooth RX context — where that timeout is not downgraded to KNOWAIT — one further +BCS from the peer parks the Bluetooth RX thread inside netbufalloc() with no possible waker, halting all HCI event processing until the device is rebooted. Separately, reusing the HF slot while a work handler was still queued or running allowed memset() to wipe live kwork items out from under the system workqueue, corrupting shared kernel workqueue state. Exploitation requires an established HFP session (for SSP devices L2CAP enforces authentication before the RFCOMM channel is reachable) and a build with CONFIGBTHFPHF enabled.