CVE-2026-81038

Name of the Vulnerable Software and Affected Versions Object Transfer Service server (affected versions not specified)

Description The Object Transfer Service server contains an issue in the oacp ind send() function within subsys/bluetooth/services/ots/ots oacp.c. When a Calculate Checksum command is issued via the Object Action Control Point (OACP), the server may attempt to append a four-byte Checksum Value from an uninitialized stack buffer declared in bt gatt ots oacp write(). This occurs on failure paths of oacp checksum proc validate() or when checksum support is disabled, leading to a call to net buf simple pull le32() on a zero-length buffer.

Because the OACP characteristic does not require pairing, encryption, or authentication, any peer within radio range can trigger this behavior. The impact depends on the build configuration: in builds with CONFIG ASSERT enabled, the system triggers an assertion in net buf simple pull mem() and panics, resulting in a remote denial of service. In builds where assertions are disabled, four bytes of uninitialized stack memory are disclosed to the peer.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.