CVE-2026-81039

Name of the Vulnerable Software and Affected Versions Zephyr (affected versions not specified)

Description A flaw exists in the Bluetooth host where a bt conn object reservation is incorrectly attributed during the connection process. In le adv start add conn() within subsys/bluetooth/host/adv.c, the host pre-allocates a reservation from the acl conns[] pool. When a connection completes, find pending connect() in subsys/bluetooth/host/hci core.c identifies the reservation using only the identity and peer address. If multiple connectable extended advertising sets are active, this lookup may return a reservation belonging to a different active set.

An adjacent device can trigger this by connecting to an undirected set using an address that maps to a peer targeted by a directed set. This causes the directed set's reservation to be consumed, while the undirected set's reservation becomes stranded and is never released. Repeated exploitation exhausts the CONFIG BT MAX CONN pool, leading to a denial of service where the device can no longer accept connections and returns -ENOMEM. Additionally, genuine connections to the directed set are dropped by bt hci disconnect() because the reservation was lost.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.