Zephyr RTOS CVE-2026-10658

Target firmware must be built from Zephyr with the Bluetooth Host stack and CONFIG_BT_ISO_RX enabled, and the attacker must be able to deliver a crafted HCI ISO Data packet with PB=START or PB=SINGLE and a payload length below the inner SDU header size (1 byte suffices to bypass hci_iso() while underflowing the 4- or 8-byte pull). The realistic delivery path is a malicious or compromised Bluetooth controller, a tampered HCI transport (UART/USB/SPI) between Host and Controller, or forwarded ISO traffic that reaches the Host through an intermediary; pure over-the-air injection by an arbitrary remote Bluetooth peer is not asserted by the description. Limiting factors: requires adjacent-network access per CVSS AV:A, requires CONFIG_BT_ISO_RX (not enabled in non-LE-Audio builds), and the more severe OOB read behavior is gated on builds with assertions disabled.

The CVSS 3.1 vector AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H yields 7.1 (High) and is consistent with the description: the attack vector is adjacent (Bluetooth controller link), unauthenticated, with low complexity and a primary availability impact, plus a minor confidentiality impact reflecting the possible OOB read in non-assert builds. There is no EPSS data, no KEV listing, and no public POC referenced beyond the vendor GHSA advisory, so this should be treated as a vendor-disclosed defect rather than active in-the-wild exploitation. Realistic risk is highest for devices where the Bluetooth controller is a separate, potentially compromisable component (e.g., HCI-over-UART/USB designs) or where forwarded ISO traffic from peers can reach the Host; pure single-chip designs with a trusted controller face lower exposure. Note that confidentiality being rated C:L while the description emphasizes DoS plus possible OOB read aligns reasonably, but defenders should verify whether their build has assertions enabled, since assert-disabled builds shift the failure mode from clean crash to potential memory disclosure.

An attacker who controls or compromises the Bluetooth controller attached to a Zephyr Host (for example, via a malicious USB Bluetooth dongle, a tampered HCI-UART link, or a compromised co-processor) sends an HCI ISO Data packet whose payload length passes the outer hci_iso() check but is smaller than the required 4- or 8-byte SDU header. bt_iso_recv() then invokes net_buf_pull_mem() on an undersized buffer, deterministically asserting and crashing the device in assert-enabled builds, or reading beyond the buffer in non-assert builds. No public exploit identified at time of analysis, but the trigger is a single malformed packet requiring no authentication.