Is CVE-2026-81039 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-81039 being exploited in the wild.

How severe is CVE-2026-81039?

Medium severity, with a CVSS score of 4.3, published 26 October 2026.

Which products and versions are affected?

Zephyr Bluetooth host Configurations with CONFIG_BT_EXT_ADV_MAX_ADV_SET > 1.

Is there a fix for CVE-2026-81039?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-81039 attacked?

It is attacked from the adjacent network, in an operating system.

Am I affected by CVE-2026-81039?

Check whether you run Zephyr Bluetooth host at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-81039: Zephyr Bluetooth host connection reservation exhaustion

CVE-2026-81039 · Severity: medium · CVSS 4.3 · Published 2026-10-26

The Zephyr Bluetooth stack's connection reservation system for extended advertising sets can be exploited by a nearby attacker to exhaust available connection slots. By sending crafted connection requests to undirected advertising sets, an attacker can cause the device to consume connection reservations without releasing them, eventually preventing legitimate connections and rendering Bluetooth connectivity unavailable.

Vendors: Zephyr.

Quick answers

Is CVE-2026-81039 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-81039 being exploited in the wild.
How severe is CVE-2026-81039?: Medium severity, with a CVSS score of 4.3, published 26 October 2026.
Which products and versions are affected?: Zephyr Bluetooth host Configurations with CONFIG_BT_EXT_ADV_MAX_ADV_SET > 1.
Is there a fix for CVE-2026-81039?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-81039 attacked?: It is attacked from the adjacent network, in an operating system.
Am I affected by CVE-2026-81039?: Check whether you run Zephyr Bluetooth host at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A logic error in find_pending_connect() allows a remote Bluetooth device to trigger misattribution of connection reservations between extended advertising sets when multiple sets are active on the same identity. An attacker crafts a connection request with an address matching a directed advertising set's peer while connecting to an undirected set, causing the directed set's reservation to be consumed while the undirected set's reservation remains stranded and unreleased. Repeated exploitation exhausts the fixed acl_conns[] pool until -ENOMEM errors prevent new connections.

Affected products

Zephyr Bluetooth host Configurations with CONFIG_BT_EXT_ADV_MAX_ADV_SET > 1

Timeline

2026-10-26: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.