CVE-2026-81039
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
A vulnerability in the Zephyr Bluetooth host causes incorrect attribution of a bt_conn reservation to an advertising set during incoming peripheral connections. When multiple extended advertising sets are enabled (CONFIG_BT_EXT_ADV_MAX_ADV_SET > 1), find_pending_connect() may return a reservation belonging to a different, still-running set, permanently leaking a connection slot. An adjacent attacker can exploit this over the air without authentication, exhausting the connection pool and causing denial of service.
Risk Assessment
The impact is availability only — an attacker within Bluetooth range can repeatedly exhaust CONFIG_BT_MAX_CONN slots until the device can no longer accept connections (-ENOMEM) until reboot or bt_disable(). There is no memory corruption or information disclosure, and single advertising set configurations are unaffected.
Recommendation
Update the Zephyr Bluetooth stack to a version containing the fix, or limit concurrent connectable advertising sets to one where feasible. Monitor logs for -ENOMEM advertising failures and consider periodic restarts of devices exposed to untrusted nearby devices.
Other vulnerabilities in Zephyr Bluetooth host
See all- CVE-2026-82388Medium
A vulnerability in the Zephyr Bluetooth stack affects bt_hfp_hf_connect(), which wipes the entire HFP Hands-Free object when bt_rfcomm_dlc_connect() fails, even though the associated SDP discovery is still outstanding. This leads to use-after-free, including NULL pointer dereferences and a self-referential SDP request list, causing a fault or unrecoverable hang in the Bluetooth host thread. The flaw is remotely reachable, e.g., via a device advertising an RFCOMM channel outside 1-30 or controlling connection timing.
- CVE-2026-19938Medium
A vulnerability in the Zephyr Bluetooth host stack causes a double-free of a net_buf in the ATT transmit path when signing fails. Additionally, on a bt_l2cap_send_pdu() failure, a buffer may be reused with a stale signature, leading to an out-of-bounds write. This results in memory corruption, crashes, or potential code execution.
- CVE-2026-12236Medium
A vulnerability in the parse_read_std_char_desc() function in the Bluetooth host subsystem (subsys/bluetooth/host/gatt.c) allows a remote, unauthenticated device to hang the Bluetooth processing thread by sending an ATT response with a zero entry length (rsp->len = 0). The parsing loop does not validate the minimum value of rsp->len, leading to an infinite loop (CWE-835) and failure to terminate descriptor discovery.
- CVE-2026-5068High
In the Bluetooth host stack, during L2CAP LE CoC SDU reassembly, a remote unauthenticated BLE peer can trigger a 2-byte out-of-bounds write. This occurs when segmentation is enabled and the chosen RX pool has user_data_size smaller than 2 bytes, causing the segmentation counter to be written out of bounds in l2cap_chan_le_recv_seg.
Original NVD description (English source)
The Bluetooth host pre-allocates a bt_conn object (a "reservation") from the fixed acl_conns[] pool for every connectable advertising set it starts, in le_adv_start_add_conn() in subsys/bluetooth/host/adv.c. When an incoming peripheral connection completes, find_pending_connect() in subsys/bluetooth/host/hci_core.c looked that reservation up using only the identity and the peer address, with a directed-then-undirected fallback, and had no knowledge of which advertising set actually terminated. With CONFIG_BT_EXT_ADV_MAX_ADV_SET > 1, where the LE Enhanced Connection Complete event is cached until the LE Advertising Set Terminated event identifies the set, this lookup can return the reservation belonging to a different, still-running advertising set. The defect is reachable over the air by any adjacent device. If an application runs two connectable extended advertising sets on the same identity — one undirected and one directed at a peer P (the common "directed reconnect to a bonded central while still accepting new centrals" pattern) — a remote initiator whose address maps to P connecting on the undirected set causes the directed set's reservation to be consumed instead. The initiator address is chosen freely by the remote device and is not authenticated at link establishment, so no bonding, pairing or prior relationship is required to trigger the mis-attribution. The undirected set's own reservation is then stranded: its BT_ADV_ENABLED flag has already been cleared, and le_adv_stop_free_conn() — the only path that returns a reservation to the pool — is reached only for sets that are still enabled, so bt_le_ext_adv_stop() returns early and the object is never released. Each occurrence permanently consumes one CONFIG_BT_MAX_CONN slot until bt_disable() or reboot. In application patterns that restart the directed advertising set after each disconnect, an attacker can repeat the sequence until the pool is exhausted, after which connectable advertising fails with -ENOMEM and the device can no longer accept connections. As a side effect the directed set keeps advertising without a reservation, so a genuine connection on it is dropped by bt_hci_disconnect(). The impact is availability only; no memory corruption or information disclosure results, and configurations with a single advertising set are unaffected.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS