An attacker can trigger a resource exhaustion condition in Zephyr's Bluetooth host by exploiting a reservation mis‑attribution bug. For every connectable advertising set that the firmware starts, it pre‑allocates a bt_conn object from a fixed acl_conns[] pool. When a peripheral connection completes, the host looks up the corresponding reservation using only the identity and peer address, without knowing which advertising set actually terminated. If the system runs multiple connectable extended advertising sets that share the same identity—such as an undirected set plus a directed set aimed at a known peer—the lookup may return the reservation belonging to the other set. The attacker’s address is chosen arbitrarily, so the flaw can be triggered without any prior pairing. The resulting mis‑assignment consumes the reservation for the directed set and leaves the undirected set stranded; its reservation never returns to the pool until the entire Bluetooth stack shuts down or the device reboots. Each repeated exploitation permanently consumes a CONFIG_BT_MAX_CONN slot, eventually causing all connectable advertising to fail with –ENOMEM and making the device unable to accept new connections. The bug affects availability only; no memory corruption or information disclosure occurs.

All Zephyr OS builds that enable extended BLE advertising (CONFIG_BT_EXT_ADV) with more than one advertising set (CONFIG_BT_EXT_ADV_MAX_ADV_SET > 1) are potentially impacted. The vulnerability is located in subsys/bluetooth/host/adv.c and subsys/bluetooth/host/hci_core.c. The issue only surfaces when an application starts multiple connectable extended advertising sets that share a single identity. Single‑set configurations remain unaffected. No specific product or version is listed as fixed, so the current known state applies to all affected firmware handling multiple advertising sets.

The CVSS score of 4.3 indicates a moderate risk. EPSS is not available, and the vulnerability is not listed in CISA's KEV catalog. The flaw is reachable over the air by any nearby device; the attacker does not need to be paired or authenticated. By repetitively initiating directed or undirected connections, a nearby unauthorized device can exhaust the host's connection pool, causing subsequent connectable advertising to fail. Because the flaw results only in resource exhaustion, the immediate business impact is a denial of service for Bluetooth connections, which could interrupt applications that rely on continuous peripheral connectivity.