Is CVE-2026-85036 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-85036 being exploited in the wild.

How severe is CVE-2026-85036?

Medium severity, with a CVSS score of 5.7, published 4 November 2026.

Which products and versions are affected?

Zephyr RTOS affected builds with CONFIG_BT_CLASSIC and CONFIG_BT_A2DP enabled.

How is CVE-2026-85036 attacked?

It is attacked from the adjacent network, in an operating system.

Am I affected by CVE-2026-85036?

Check whether you run Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-85036: Zephyr Bluetooth Classic AVDTP memory corruption in work queue

CVE-2026-85036 · Severity: medium · CVSS 5.7 · Published 2026-11-04

Zephyr RTOS's Bluetooth Classic AVDTP (audio streaming protocol) layer has a flaw that allows a paired Bluetooth device to trigger memory corruption in the system work queue, causing the system to hang or stop processing tasks. An attacker with a bonded BR/EDR Bluetooth connection can send two signaling commands in quick succession to reuse a session object while a cleanup task is still pending, corrupting the queue and requiring a device reboot to recover.

Technologies: Zephyr RTOS. Vendors: Zephyr.

Quick answers

Is CVE-2026-85036 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-85036 being exploited in the wild.
How severe is CVE-2026-85036?: Medium severity, with a CVSS score of 5.7, published 4 November 2026.
Which products and versions are affected?: Zephyr RTOS affected builds with CONFIG_BT_CLASSIC and CONFIG_BT_A2DP enabled.
Is there a fix for CVE-2026-85036?: Yes: fixed in Commits ec822ceed83b and 2bd5ea88c69b (both required). Until then: Disable Bluetooth Classic (CONFIG_BT_CLASSIC) or A2DP profile support (CONFIG_BT_A2DP) if these features are not required, or restrict Bluetooth pairing to trusted devices only, as the attack requires an already-bonded BR/EDR connection. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-85036 attacked?: It is attacked from the adjacent network, in an operating system.
Am I affected by CVE-2026-85036?: Check whether you run Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Commits ec822ceed83b and 2bd5ea88c69b (both required)

Disable Bluetooth Classic (CONFIG_BT_CLASSIC) or A2DP profile support (CONFIG_BT_A2DP) if these features are not required, or restrict Bluetooth pairing to trusted devices only, as the attack requires an already-bonded BR/EDR connection.

Technical details

The vulnerability is a use-after-free variant caused by improper synchronization between the BT RX work queue and system work queue. When bt_avdtp_l2cap_disconnected() queues a deferred release work item to k_sys_work_q.pending, a subsequent L2CAP Connection Request on the same PSM can trigger a2dp_get_connection() which memset()s the session struct while the work item is still linked in the queue. This corrupts the work queue's doubly-linked list structure, causing either queue starvation (new work items become unreachable) or infinite loops (self-referencing nodes). The fix requires two interdependent commits: one adding pending-release checks to connection paths, and another making a2dp_get_connection() detect and reject reuse while release work is queued.

Affected products

Zephyr Zephyr RTOS affected builds with CONFIG_BT_CLASSIC and CONFIG_BT_A2DP enabled

Timeline

2026-11-04: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.