# CVE-2026-85036: Zephyr Bluetooth Classic AVDTP memory corruption in work queue

Source: https://junglewise.ai/threats/cve-2026-85036-the-bluetooth-classic-avdtp-layer-defers-releasing-a-session-s  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-04. Updated: 2026-11-04  
License: CC BY 4.0 with a link back

CVE-2026-85036 · Severity: medium · CVSS 5.7 · Published 2026-11-04

Zephyr RTOS's Bluetooth Classic AVDTP (audio streaming protocol) layer has a flaw that allows a paired Bluetooth device to trigger memory corruption in the system work queue, causing the system to hang or stop processing tasks. An attacker with a bonded BR/EDR Bluetooth connection can send two signaling commands in quick succession to reuse a session object while a cleanup task is still pending, corrupting the queue and requiring a device reboot to recover.

Technologies: [Zephyr RTOS](https://junglewise.ai/threats/technologies/rtos). Vendors: [Zephyr](https://junglewise.ai/threats/vendors/zephyr).

## Quick answers

**Is CVE-2026-85036 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-85036 being exploited in the wild.

**How severe is CVE-2026-85036?** Medium severity, with a CVSS score of 5.7, published 4 November 2026.

**Which products and versions are affected?** Zephyr RTOS affected builds with CONFIG_BT_CLASSIC and CONFIG_BT_A2DP enabled.

**Is there a fix for CVE-2026-85036?** Yes: fixed in Commits ec822ceed83b and 2bd5ea88c69b (both required). Until then: Disable Bluetooth Classic (CONFIG_BT_CLASSIC) or A2DP profile support (CONFIG_BT_A2DP) if these features are not required, or restrict Bluetooth pairing to trusted devices only, as the attack requires an already-bonded BR/EDR connection. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-85036 attacked?** It is attacked from the adjacent network, in an operating system.

**Am I affected by CVE-2026-85036?** Check whether you run Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Commits ec822ceed83b and 2bd5ea88c69b (both required)

Disable Bluetooth Classic (CONFIG_BT_CLASSIC) or A2DP profile support (CONFIG_BT_A2DP) if these features are not required, or restrict Bluetooth pairing to trusted devices only, as the attack requires an already-bonded BR/EDR connection.

## Technical details

The vulnerability is a use-after-free variant caused by improper synchronization between the BT RX work queue and system work queue. When bt_avdtp_l2cap_disconnected() queues a deferred release work item to k_sys_work_q.pending, a subsequent L2CAP Connection Request on the same PSM can trigger a2dp_get_connection() which memset()s the session struct while the work item is still linked in the queue. This corrupts the work queue's doubly-linked list structure, causing either queue starvation (new work items become unreachable) or infinite loops (self-referencing nodes). The fix requires two interdependent commits: one adding pending-release checks to connection paths, and another making a2dp_get_connection() detect and reject reuse while release work is queued.

## Affected products

- Zephyr Zephyr RTOS affected builds with CONFIG_BT_CLASSIC and CONFIG_BT_A2DP enabled

## Timeline

- 2026-11-04: disclosed

## Related threats

- [Zephyr RFCOMM multiplexer buffer overflow and information disclosure](https://junglewise.ai/threats/cve-2026-77685-the-rfcomm-multiplexer-control-channel-handler-in-subsys)
- [Xtensa MMU uninitialized page-table pointer in userspace thread setup](https://junglewise.ai/threats/cve-2026-90586-the-xtensa-mmu-userspace-port-never-initialized-the-per-thread)
- [Zephyr HTTP/2 server NULL pointer dereference in stream binding](https://junglewise.ai/threats/cve-2026-87045-the-http-2-server-in-subsys-net-lib-http-http-server-http2-c)
- [Zephyr RTIO submission-queue verifier memory access bypass](https://junglewise.ai/threats/cve-2026-87041-the-rtio-submission-queue-verifier-rtio-vrfy-sqe-in-subsys-rtio)
- [Zephyr i3c_transfer TOCTOU privilege escalation](https://junglewise.ai/threats/cve-2026-87038-the-user-mode-verification-handler-for-the-i3c-transfer-system)