Zephyr Bluetooth Host CVE-2026-81039

Exploitation requires a non-default Zephyr build with CONFIG_BT_EXT_ADV_MAX_ADV_SET > 1 (so the Enhanced Connection Complete event is cached pending the Advertising Set Terminated event) and a finite CONFIG_BT_MAX_CONN pool, plus an application that concurrently runs two connectable extended advertising sets on the same identity - one undirected and one directed at a peer P. Both Kconfig options default to 1, so stock/single-advertising-set configurations are not vulnerable. Given that configuration, no bonding, pairing, or prior relationship is needed: an adjacent attacker freely chooses an initiator address mapping to P and connects on the undirected set, and the address is not authenticated at link establishment. Limiting factors are the mandatory non-default dual-advertising-set deployment and Bluetooth radio proximity (adjacent, not remote/Internet-routable); maximal impact (full pool exhaustion) additionally depends on the app restarting the directed set after each disconnect so the sequence can be repeated.

All signals point to a genuine but moderate availability-only issue, not a top-priority emergency. The vendor CVSS vector (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, base 4.3) scopes the impact to availability with no confidentiality or integrity effect, exploitable by an unauthenticated adjacent attacker (Bluetooth radio range) at low complexity. There is no CISA KEV listing, no EPSS score provided in the input, and no PoC or exploit reference - only patch commits and the GHSA advisory - so exploitation status is 'no public exploit identified at time of analysis.' The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with a real-but-bounded resource-leak DoS. The most important limiting factor, confirmed by the advisory and Kconfig evidence, is that the flaw only manifests in a non-default configuration: CONFIG_BT_EXT_ADV_MAX_ADV_SET and CONFIG_BT_MAX_CONN both default to 1, and single-advertising-set builds are unaffected. No signals conflict; the main gap is the absence of EPSS data, so widespread-versus-targeted exploitation likelihood cannot be quantified from the input. Net: prioritize for affected multi-advertising-set deployments within the vendor's suggested timeframe, but it is not a drop-everything issue.

A device runs two connectable extended advertising sets on one identity - one undirected, one directed at a bonded central P - the common 'reconnect to a bonded peer while still accepting new centrals' pattern. An attacker within Bluetooth range, choosing an initiator address that maps to P, connects on the undirected set, causing the host to consume and then strand the directed set's connection reservation; repeating this until the acl_conns[] pool is exhausted denies all further connectable advertising. No public exploit code is identified at time of analysis, and the adjacent (AV:A), low-complexity (AC:L) vector means the attacker only needs radio proximity and no authentication.