Zephyr RTOS
CVE-2026-10651
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLocate Bluetooth Classic device in range
-
DeliveryEstablish L2CAP connection to SDP PSM
-
ExploitSend malformed 3-byte SDP attribute (09 00 09)
-
ExecutionTrigger net_buf_simple_pull length assertion
-
ImpactKernel panic and device reboot (DoS)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Requires that the target device runs Zephyr with the Bluetooth Classic (BR/EDR) host stack compiled in (CONFIG_BT_CLASSIC) and that the attacker is within Bluetooth radio range (AV:A, typically <10m for Class 2 radios). The attacker must be able to reach the SDP server - for many Zephyr profiles this is possible to any peer that can establish an L2CAP connection to PSM 0x0001, which on discoverable devices needs no prior pairing. Kernel panic outcome is limited to builds with CONFIG_ASSERT enabled (common in development and many production images); assertion-disabled builds instead suffer an out-of-bounds read with undefined parser behavior. BLE-only Zephyr configurations are not affected. |
| Impact | The CVSS 3.1 vector AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H scores 7.1 (High) and is internally consistent: AV:A reflects that Bluetooth Classic requires adjacent (radio-range) access, AC:L matches a single malformed packet, PR:N/UI:N because any peer that can initiate an SDP query can trigger it, and A:H captures the kernel panic. C:L is somewhat generous and likely accounts for the assertion-disabled out-of-bounds read leaking memory contents. No EPSS, KEV, or SSVC data was supplied, so real-world exploitation probability cannot be quantified - however, the bug is trivially reachable by any Bluetooth peer once pairing/connection is established (or even pre-pairing for SDP in some stacks), so for fielded devices exposing Bluetooth Classic this is a credible DoS primitive. The product is embedded firmware that often cannot be patched in the field, which amplifies real-world impact beyond what the score alone suggests. |
| Exploit ScenarioDerived | An attacker within Bluetooth radio range of a Zephyr-based device (smartwatch, hearable, industrial sensor, medical device) initiates an SDP service search and sends a single crafted attribute containing only 3 bytes such as 09 00 09. The parser asserts and the device kernel panics, dropping any active connections and requiring a reboot; repeated transmission produces a persistent denial of service against any Bluetooth Classic device in range. No public PoC is referenced, but the description provides a working trigger byte sequence. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 23, 2026
Denial of service in Zephyr RTOS Bluetooth Classic SDP parser allows adjacent Bluetooth attackers to crash devices via a malformed 3-byte SDP attribute that triggers a reachable kernel assertion. The flaw resides in bt_sdp_parse_attribute() in subsys/bluetooth/host/classic/sdp.c, where the parser pulls a value-type byte without first verifying buffer length, causing a kernel panic in assert-enabled builds and an out-of-bounds read with undefined behavior when assertions are disabled. No public exploit identified at time of analysis, though the GHSA advisory describes the trigger conditions in enough detail to reproduce.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed - consult the Zephyr GHSA-p93g-3r68-cj53 advisory at https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-p93g-3r68-cj53 for the exact patched release tag and backports, then rebuild and reflash device firmware. As a compensating control where reflashing is not immediately possible, disable Bluetooth Classic (CONFIG_BT_CLASSIC=n) and rely on BLE only if the product supports it, accepting the loss of BR/EDR profiles such as A2DP, HFP, and SPP. Where Bluetooth Classic must remain enabled, reduce exposure by keeping devices in non-discoverable mode and restricting SDP queries to bonded peers via application-layer connection policy, recognizing this only delays rather than prevents exploitation by an already-paired attacker. Disabling CONFIG_ASSERT to avoid the panic is NOT a fix - it converts the crash into a silent out-of-bounds read with undefined behavior, which is worse.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Zephyr is a small-footprint open-source real-time operating system widely used in IoT, wearables, and embedded devices, maintained by the Linux Foundation's Zephyr Project (cpe:2.3:a:zephyrproject-rtos:zephyr). The vulnerable code path lives in the Bluetooth Classic (BR/EDR) host stack's Service Discovery Protocol parser. SDP attributes are TLV-style structures: a 1-byte attribute type, 2-byte attribute ID, then a value whose first byte declares the value type. bt_sdp_parse_attribute() validates only that the first 3 bytes are present before calling net_buf_simple_pull() for an additional byte, violating CWE-20 (Improper Input Validation). When CONFIG_ASSERT is enabled, __ASSERT_NO_MSG(buf->len >= len) panics the kernel; when disabled, the pull proceeds past the buffer end, returning attacker-influenced memory contents and corrupting subsequent parser state.
Know when Zephyr gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Adjacent Bluetooth range (AV:A), single malformed packet (AC:L), no auth needed to query SDP (PR:N), kernel panic (A:H), minor info leak in assert-disabled builds (C:L).
Primary rating from Vendor (zephyr).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
A malformed Bluetooth Classic SDP attribute can trigger a reachable assertion in Zephyr's SDP parser. In subsys/bluetooth/host/classic/sdp.c, bt_sdp_parse_attribute() accepts an input buffer once it contains the 1-byte attribute type and 2-byte attribute id, but then unconditionally pulls an additional byte for the value type without verifying that the byte is present. A truncated 3-byte attribute (for example 09 00 09) therefore reaches net_buf_simple_pull() with insufficient remaining length, triggering the __ASSERT_NO_MSG(buf->len >= len) check and a kernel panic in assert-enabled builds (denial of service). In builds where assertions are disabled, parsing may continue past the end of the available buffer, leading to an out-of-bounds read and undefined behavior.
Executive ViewAI
Zephyr RTOS devices with Bluetooth Classic enabled are vulnerable to denial of service attacks from adjacent attackers, creating availability risks for IoT and embedded systems deployments. The vulnerability requires attackers to be within Bluetooth radio proximity and presents minimal attack complexity. Organizations with affected Zephyr deployments lack vendor-provided patches and should immediately implement interim mitigations to reduce exposure.
No vendor-released patch identified at time of analysis. Interim mitigations include: (1) disabling Bluetooth Classic on non-dependent devices; (2) implementing Bluetooth network segmentation and access controls to limit proximity-based attacks; (3) monitoring for unusual Bluetooth SDP query patterns; (4) maintaining device inventory and network topology documentation for coordinated patch deployment when available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)NVD
Potential off-by-one buffer overflow vulnerability in the Zephyr fuse file system. Rated critical severity (CVSS 10.0),
An out-of-bounds write in the Zephyr RTOS DNS resolver (dns_unpack_name()) lets a crafted DNS response corrupt memory on
Possible variant of CVE-2021-3434 in function le_ecred_reconf_req. Rated critical severity (CVSS 9.8), this vulnerabilit
Unchecked user input length in /subsys/net/l2/wifi/wifi_shell.c can cause buffer overflows. Rated critical severity (CVS
Potential buffer overflow vulnerability in the Zephyr CAN bus subsystem. Rated critical severity (CVSS 9.8), this vulner
Integer Underflow in 6LoWPAN IPHC Header Uncompression in Zephyr. Rated critical severity (CVSS 9.8), this vulnerability
Buffer overflow in Zephyr USB DFU DNLOAD. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable
DOS: Incorrect 802154 Frame Validation for Omitted Source / Dest Addresses. Rated critical severity (CVSS 9.8), this vul
zephyr-rtos version 1.12.0 contains a NULL base pointer reference vulnerability in sys_ring_buf_put(), sys_ring_buf_get(
Potential buffer overflow vulnerabilities n the Zephyr Bluetooth subsystem. Rated critical severity (CVSS 9.6), this vul
The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC defines for a Bluetooth characte
Potential buffer overflows in the Bluetooth subsystem due to asserts being disabled in /subsys/bluetooth/host/hci_core.c
Exploit-DB