Zephyr RTOS EUVD-2026-40369

Exploitation requires the attacker to be within Bluetooth radio range and have an established Bluetooth Classic RFCOMM connection with the target device (AV:A). The race window only exists during the narrow interval when the local Zephyr stack has entered BT_RFCOMM_STATE_DISCONNECTING - meaning a local-initiated session teardown must already be underway simultaneously with the attacker's DISC transmission (AC:H). The target must be running Zephyr compiled with CONFIG_BT_RFCOMM enabled. The CVSS PR:N metric indicates no system-level privileges are required beyond establishing the Bluetooth connection. Limiting factors include: the attacker cannot remotely trigger or observe the local disconnect event, the timing window is scheduler- and hardware-dependent making consistent triggering uncertain, and impact is strictly limited to availability of RFCOMM service for that peer - no memory corruption, privilege escalation, or data exposure is possible.

The CVSS 3.1 base score of 3.1 (Low) with vector AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L is well-calibrated: exploitation requires physical or radio Bluetooth adjacency (AV:A), a high-complexity timing race difficult to control reliably (AC:H), and yields only limited availability impact (A:L) with no confidentiality or integrity consequence. No EPSS score was included in the source data, so exploitation probability is inferred; the AC:H requirement and absence of both KEV listing and known public exploit code strongly suggest opportunistic mass exploitation is implausible. For most environments this is a low priority, but in Zephyr-based embedded deployments where RFCOMM services are operationally critical - industrial serial-over-Bluetooth, medical device communication, or automotive profiles - repeated DoS of the session pool carries disproportionate operational risk relative to the raw CVSS score. The 'Information Disclosure' tag in the source metadata is inconsistent with both the CVE description (explicitly states no confidentiality consequence) and the CVSS C:N metric; it is assessed as erroneous labeling and should not influence triage.

An attacker within Bluetooth radio range of a Zephyr device establishes an RFCOMM session and then, at the precise moment the local device independently initiates a session teardown, transmits a DISC frame for dlci 0. If the timing race succeeds, the session slot in bt_rfcomm_pool is permanently wedged and the L2CAP channel is never freed. Repeating this across successive reconnects exhausts the session pool, causing all subsequent bt_rfcomm_dlc_connect() calls to return -EINVAL and denying RFCOMM service entirely. No public exploit code exists at time of analysis, and the high-complexity timing requirement makes reliable exploitation difficult to automate.