CVE-2026-10658
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
A missing length validation in the Zephyr Bluetooth Host ISO receive path allows malformed HCI ISO data to trigger a kernel assert (denial of service) or out-of-bounds read.
Risk Assessment
An attacker can cause a system crash (DoS) by sending a crafted HCI ISO packet, disrupting devices running Zephyr with ISO reception enabled.
Recommendation
Update Zephyr to a patched version that adds length checks in bt_iso_recv(), or disable CONFIG_BT_ISO_RX if not needed.
Original NVD description (English source)
A missing length validation in the Zephyr Bluetooth Host ISO receive path can be triggered by malformed HCI ISO data. In bt_iso_recv() (subsys/bluetooth/host/iso.c), when processing PB=START/SINGLE fragments, the code pulls a TS SDU header (8 bytes, ts=1) or a non-TS SDU header (4 bytes, ts=0) without first verifying that buf->len contains at least that many bytes. The outer HCI ISO length check in hci_iso() validates payload length consistency but not the minimum inner SDU header size, so a packet with payload length 1 passes hci_iso() and then reaches net_buf_pull_mem(), which asserts buf->len >= len. As a result, malformed ISO traffic deterministically triggers a kernel assert (denial of service) in assert-enabled builds, and in non-assert builds the same path may proceed with an undersized buffer, leading to out-of-bounds read behavior. The issue affects products using the Zephyr Host with CONFIG_BT_ISO_RX enabled, particularly where incoming HCI data can be influenced by a malicious or compromised controller or malformed forwarded ISO traffic.