CVE-2026-81039 Bluetooth Host connection reservation leak when multiple connectable advertising sets share an identity

The Bluetooth host pre-allocates a btconn object a "reservation" from the fixed aclconns pool for every connectable advertising set it starts, in leadvstartaddconn in subsys/bluetooth/host/adv.c. When an incoming peripheral connection completes, findpendingconnect in subsys/bluetooth/host/hcicore...

CVE-2026-81039

The Bluetooth host contains a connection reservation leak in the subsys/bluetooth/host/adv.c and subsys/bluetooth/host/hci_core.c components. When multiple connectable advertising sets share an identity and CONFIG_BT_EXT_ADV_MAX_ADV_SET > 1, the host incorrectly attributes reservations to the ...