Bluetooth Host Connection Vulnerability in Zephyr Project Software by Zephyr Project

CVE-2026-81039

What is CVE-2026-81039?

The Bluetooth host within Zephyr Project software has a vulnerability arising from improper handling of connection reservations for multiple advertising sets. The flaw allows an adjacent device to exploit the connection mechanism where an incoming connection can incorrectly consume a reservation intended for a different advertising set. This misallocation of resources can lead to exhaustion of connection slots, causing an application to fail to accept new connections. While this vulnerability only affects availability and does not lead to memory corruption or data disclosure, it poses significant risks for systems operating with multiple connectable extended advertising sets.

References