What is the CVSS score of CVE-2026-10651?

CVE-2026-10651 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of Zephyr RTOS are affected by CVE-2026-10651?

Zephyr RTOS devices with Bluetooth Classic enabled are vulnerable to denial of service attacks from adjacent attackers, creating availability risks for IoT and embedded systems deployments.

How to fix or mitigate CVE-2026-10651?

Within 24 hours: Identify and document all Zephyr RTOS devices with Bluetooth Classic enabled, including firmware versions and deployment locations. Within 7 days: Implement Bluetooth network isolation or access controls where operationally feasible; disable Bluetooth Classic on devices without functional dependency on it. Within 30 days: Monitor Zephyr project security advisories for patch release; evaluate firmware update procedures for deployed devices to enable rapid patching when available.

Zephyr RTOS CVE-2026-10651

MEDIUM

Improper Input Validation (CWE-20)

2026-06-22 zephyr

Buffer Overflow Denial Of Service Zephyr Zephyrproject Rtos

6.5

CVSS 3.1 · NVD

Severity by source

Vendor (zephyr) PRIMARY

HIGH

qualitative

NVD

6.5 MEDIUM

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.1 HIGH

Adjacent Bluetooth range (AV:A), single malformed packet (AC:L), no auth needed to query SDP (PR:N), kernel panic (A:H), minor info leak in assert-disabled builds (C:L).

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (zephyr).

CVSS VectorNVD

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Severity Changed

Jul 06, 2026 - 19:52 NVD

HIGH MEDIUM

CVSS changed

Jul 06, 2026 - 19:52 NVD

7.1 (HIGH) 6.5 (MEDIUM)

Analysis Generated

Jun 23, 2026 - 00:42 vuln.today

DescriptionNVD

A malformed Bluetooth Classic SDP attribute can trigger a reachable assertion in Zephyr's SDP parser. In subsys/bluetooth/host/classic/sdp.c, bt_sdp_parse_attribute() accepts an input buffer once it contains the 1-byte attribute type and 2-byte attribute id, but then unconditionally pulls an additional byte for the value type without verifying that the byte is present. A truncated 3-byte attribute (for example 09 00 09) therefore reaches net_buf_simple_pull() with insufficient remaining length, triggering the __ASSERT_NO_MSG(buf->len >= len) check and a kernel panic in assert-enabled builds (denial of service). In builds where assertions are disabled, parsing may continue past the end of the available buffer, leading to an out-of-bounds read and undefined behavior.

AnalysisAI

Denial of service in Zephyr RTOS Bluetooth Classic SDP parser allows adjacent Bluetooth attackers to crash devices via a malformed 3-byte SDP attribute that triggers a reachable kernel assertion. The flaw resides in bt_sdp_parse_attribute() in subsys/bluetooth/host/classic/sdp.c, where the parser pulls a value-type byte without first verifying buffer length, causing a kernel panic in assert-enabled builds and an out-of-bounds read with undefined behavior when assertions are disabled. No public exploit identified at time of analysis, though the GHSA advisory describes the trigger conditions in enough detail to reproduce.

Technical ContextAI

Zephyr is a small-footprint open-source real-time operating system widely used in IoT, wearables, and embedded devices, maintained by the Linux Foundation's Zephyr Project (cpe:2.3:a:zephyrproject-rtos:zephyr). The vulnerable code path lives in the Bluetooth Classic (BR/EDR) host stack's Service Discovery Protocol parser. SDP attributes are TLV-style structures: a 1-byte attribute type, 2-byte attribute ID, then a value whose first byte declares the value type. bt_sdp_parse_attribute() validates only that the first 3 bytes are present before calling net_buf_simple_pull() for an additional byte, violating CWE-20 (Improper Input Validation). When CONFIG_ASSERT is enabled, __ASSERT_NO_MSG(buf->len >= len) panics the kernel; when disabled, the pull proceeds past the buffer end, returning attacker-influenced memory contents and corrupting subsequent parser state.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - consult the Zephyr GHSA-p93g-3r68-cj53 advisory at https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-p93g-3r68-cj53 for the exact patched release tag and backports, then rebuild and reflash device firmware. As a compensating control where reflashing is not immediately possible, disable Bluetooth Classic (CONFIG_BT_CLASSIC=n) and rely on BLE only if the product supports it, accepting the loss of BR/EDR profiles such as A2DP, HFP, and SPP. Where Bluetooth Classic must remain enabled, reduce exposure by keeping devices in non-discoverable mode and restricting SDP queries to bonded peers via application-layer connection policy, recognizing this only delays rather than prevents exploitation by an already-paired attacker. Disabling CONFIG_ASSERT to avoid the panic is NOT a fix - it converts the crash into a silent out-of-bounds read with undefined behavior, which is worse.