Zephyr RTOS
CVE-2026-10658
HIGH
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Adjacent Bluetooth/HCI vector, no auth or UI, deterministic crash gives A:H, possible OOB read in non-assert builds justifies C:L, no integrity impact.
Primary rating from Vendor (zephyr).
CVSS VectorVendor: zephyr
Lifecycle Timeline
2DescriptionCVE.org
A missing length validation in the Zephyr Bluetooth Host ISO receive path can be triggered by malformed HCI ISO data. In bt_iso_recv() (subsys/bluetooth/host/iso.c), when processing PB=START/SINGLE fragments, the code pulls a TS SDU header (8 bytes, ts=1) or a non-TS SDU header (4 bytes, ts=0) without first verifying that buf->len contains at least that many bytes. The outer HCI ISO length check in hci_iso() validates payload length consistency but not the minimum inner SDU header size, so a packet with payload length 1 passes hci_iso() and then reaches net_buf_pull_mem(), which asserts buf->len >= len. As a result, malformed ISO traffic deterministically triggers a kernel assert (denial of service) in assert-enabled builds, and in non-assert builds the same path may proceed with an undersized buffer, leading to out-of-bounds read behavior. The issue affects products using the Zephyr Host with CONFIG_BT_ISO_RX enabled, particularly where incoming HCI data can be influenced by a malicious or compromised controller or malformed forwarded ISO traffic.
AnalysisAI
Denial-of-service and potential out-of-bounds read in the Zephyr RTOS Bluetooth Host ISO receive path allows a malicious or compromised Bluetooth controller to crash devices using CONFIG_BT_ISO_RX by sending malformed HCI ISO packets with undersized SDU headers. The flaw resides in bt_iso_recv() within subsys/bluetooth/host/iso.c, where header bytes are pulled without prior length validation. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Technical ContextAI
Zephyr is a widely used open-source real-time operating system for resource-constrained connected and IoT devices, maintained by the Zephyr Project (a Linux Foundation project) and indexed in CPE as cpe:2.3:a:zephyrproject-rtos:zephyr. The vulnerability sits in the Bluetooth Host's Isochronous Channel (ISO) receive logic, used for LE Audio and similar features. When processing PB=START or PB=SINGLE fragments, bt_iso_recv() calls net_buf_pull_mem() to remove an 8-byte timestamped or 4-byte non-timestamped SDU header from the packet buffer without first checking that buf->len holds at least that many bytes. The outer hci_iso() handler validates the HCI ISO payload length envelope but does not enforce a minimum inner SDU header size. This is a classic missing-bounds-check pattern (CWE-125 out-of-bounds read / CWE-1284 improper validation of specified quantity in input), where the net_buf_pull_mem() assertion fires in assert-enabled builds and silent under-read corruption can occur otherwise.
RemediationAI
Upstream fix available (PR/commit per GHSA-26g8-rmpf-j6cw); released patched version not independently confirmed from the provided data - consult https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-26g8-rmpf-j6cw and update to the corresponding Zephyr LTS or main-branch tag once identified, then rebuild and reflash affected firmware. If patching is not immediately feasible, the most direct compensating control is to disable CONFIG_BT_ISO_RX in Kconfig for devices that do not require LE Audio reception, which fully removes the vulnerable code path but breaks any ISO-based audio or isochronous data feature; alternatively, enforce a trusted controller boundary (e.g., integrated controller, signed controller firmware, or physically protected HCI transport) so that malformed HCI ISO frames cannot be injected. Keeping assertion builds enabled converts the issue from possible OOB read to a clean fault, which is preferable for safety-critical or attended devices but unacceptable where availability is paramount.
Potential off-by-one buffer overflow vulnerability in the Zephyr fuse file system. Rated critical severity (CVSS 10.0),
Possible variant of CVE-2021-3434 in function le_ecred_reconf_req. Rated critical severity (CVSS 9.8), this vulnerabilit
Unchecked user input length in /subsys/net/l2/wifi/wifi_shell.c can cause buffer overflows. Rated critical severity (CVS
Potential buffer overflow vulnerability in the Zephyr CAN bus subsystem. Rated critical severity (CVSS 9.8), this vulner
Integer Underflow in 6LoWPAN IPHC Header Uncompression in Zephyr. Rated critical severity (CVSS 9.8), this vulnerability
Buffer overflow in Zephyr USB DFU DNLOAD. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable
DOS: Incorrect 802154 Frame Validation for Omitted Source / Dest Addresses. Rated critical severity (CVSS 9.8), this vul
zephyr-rtos version 1.12.0 contains a NULL base pointer reference vulnerability in sys_ring_buf_put(), sys_ring_buf_get(
Potential buffer overflow vulnerabilities n the Zephyr Bluetooth subsystem. Rated critical severity (CVSS 9.6), this vul
Buffer overflow in Zephyr RTOS dns_unpack_name() function causing OOB writes. PoC available.
The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC defines for a Bluetooth characte
Potential buffer overflows in the Bluetooth subsystem due to asserts being disabled in /subsys/bluetooth/host/hci_core.c
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today