Zephyr Project: Four Bluetooth Host Vulnerabilities Disclosed Together, One High Severity
Key findings • Four Bluetooth vulnerabilities in Zephyr Project disclosed on October 26, 2026. • High severity flaw CVE-2026-81038 in Object Transfer Service checksum handling. • Medium s…
Key findings
- Four Bluetooth vulnerabilities in Zephyr Project disclosed on October 26, 2026.
- High severity flaw CVE-2026-81038 in Object Transfer Service checksum handling.
- Medium severity CVE-2026-82389 and CVE-2026-82388 impact HFP profile SDP discovery.
- Medium severity CVE-2026-81039 relates to ACL connection object management.
- All vulnerabilities addressed by Zephyr Project updates.
On October 26, 2026, the Zephyr Project disclosed four vulnerabilities affecting its Bluetooth host subsystem. These vulnerabilities, ranging in severity from Medium to High, were all published simultaneously, indicating a coordinated disclosure event. The most critical of these, CVE-2026-81038, is a High severity flaw in the Object Transfer Service (OTS) server's handling of checksum calculations, potentially leading to improper response construction.
Two of the Medium severity vulnerabilities, CVE-2026-82389 and CVE-2026-82388, stem from issues within the Bluetooth Classic Hands-Free Profile (HFP) implementation. CVE-2026-82389 in the Audio Gateway role involves an improper linking of an SDP discovery parameter, while CVE-2026-82388 in the Hands-Free unit role has a similar issue with its SDP discovery process. Both relate to how the system manages pending SDP requests.
Another Medium severity vulnerability, CVE-2026-81039, affects the Bluetooth host's connection management. This flaw arises from how ACL connection objects are reserved and managed, potentially leading to issues when handling incoming peripheral connections after an advertising set has been started.
The High severity CVE-2026-81038 specifically impacts the Object Transfer Service server. The vulnerability lies in the oacp_ind_send() function, where a four-byte Checksum Value field was appended unconditionally when the BT_GATT_OTS_OACP_PROC_CHECKSUM_CALC opcode was requested. This could lead to an improperly formed response, potentially impacting the integrity of data transfer operations.
The Zephyr Project has addressed these vulnerabilities. Users are advised to update to the latest version of the Zephyr Project to mitigate these risks. The coordinated disclosure of these four distinct issues highlights the importance of regular security audits within complex subsystems like Bluetooth.
The simultaneous disclosure of these vulnerabilities underscores the need for prompt patching and awareness among developers utilizing the Zephyr RTOS. Staying updated with security advisories and applying patches promptly is crucial for maintaining the security posture of embedded systems.