CVE-2026-28606 AI-generated analysis
platform/packages/modules/Bluetooth, btservice/AdapterService (bond state handling)
The Bluetooth AdapterService now removes the per-device CallerInfo entry from mBondAttemptCallerInfo whenever a bond state transition lands in any state other than BOND_BONDING, so caller information from a finished or failed bonding attempt is no longer kept.
Root cause
AdapterService keeps a map, mBondAttemptCallerInfo, keyed by device address and holding a CallerInfo for a device's bonding attempt. The bond state transition handler in AdapterService.java receives toState and resets the phonebook and SIM access permissions on the relevant transitions, but it never removed that entry. So once bonding reached BOND_BONDED or BOND_NONE, the CallerInfo stayed in the map even though it described an attempt that had already finished. The material does not show which code reads mBondAttemptCallerInfo, so how the stale record was used is not visible.
How the fix works
- android/app/src/com/android/bluetooth/btservice/AdapterService.java: adds a static import of BluetoothDevice.BOND_BONDING.
- android/app/src/com/android/bluetooth/btservice/AdapterService.java, bond state transition handler (hunk after the setPhonebookAccessPermission/setSimAccessPermission reset block): adds `if (toState != BOND_BONDING) { CallerInfo callerInfo = mBondAttemptCallerInfo.remove(device.getAddress()); if (callerInfo != null) Log.d(...) }`. The entry is now dropped on every transition to a state other than BOND_BONDING.
- The Android 15 (9b196f44770c) and Android 16 (07542331e7c4) commits apply this unconditionally. Their commit message names the aconfig flag com.android.bluetooth.flags.remove_bond_caller_info, but the diff has no Flags check.
- Android 17 (1b0d684402b2, 'Unflag remove_bond_caller_info'): changes the earlier flagged form `if (Flags.removeBondCallerInfo() && toState != BOND_BONDING)` to `if (toState != BOND_BONDING)` and deletes the remove_bond_caller_info flag definition from flags/pairing.aconfig, so the cleanup is always active.
Completeness
- Covers: cleanup of mBondAttemptCallerInfo on any bond state change whose target state is not BOND_BONDING (i.e. BOND_BONDED and BOND_NONE), for the device whose state changed.
- Cleanup happens only in the bond state callback. The material does not show whether the map is also cleared when the adapter is turned off or the service is torn down while a device is still in BOND_BONDING (unverified).
- The code that inserts into mBondAttemptCallerInfo and the code that reads it are not in the diff or context, so it cannot be judged whether the readers also validate the record.
- The removal does nothing and nothing is logged when no entry exists for the device.
Behavior changes
- mBondAttemptCallerInfo entries now last only through the BOND_BONDING phase. After a device's bond completes or fails, no CallerInfo from that attempt remains.
- A new debug log 'Removed bond caller info for device: <device>' is emitted when an entry is removed.
- On Android 17 the behaviour is no longer gated by the remove_bond_caller_info aconfig flag, and that flag is removed from flags/pairing.aconfig.
Per major
- Android 14: not affected per the bulletin; android-security-14.0.0_r29 contains 5/8 lines of the patched region. The material does not show which lines those are or whether mBondAttemptCallerInfo exists there.
- Android 15: same fix, unconditional (no Flags check despite the Flag: line in the commit message), commit 9b196f44770c in android-security-15.0.0_r17, 8/8 lines present
- Android 16: same fix, unconditional, commit 07542331e7c4 in android-security-16.0.0_r8, 8/8 lines present
- Android 17: adapted: the removal block was already present behind Flags.removeBondCallerInfo(). Commit 1b0d684402b2 in android-security-17.0.0_r1 drops the flag check and deletes the remove_bond_caller_info flag from flags/pairing.aconfig. 6/8 lines of the reference region are present (the reason for the difference is not shown).
Unknowns
- Which code reads mBondAttemptCallerInfo, and what decision the stale CallerInfo influenced; the EoP mechanism is not visible in the material.
- Where and under what conditions entries are inserted into mBondAttemptCallerInfo.
- The exact name of the bond state handler method (the hunk header shows only the class).
- Whether the map is cleared on adapter shutdown while a device remains in BOND_BONDING.
- Why Android 14 is treated as not affected, and which of the patched-region lines exist there.
- Why only 6/8 lines of the reference region match at android-security-17.0.0_r1.