Zephyr Bluetooth EUVD-2026-97107

Exploitation requires the target firmware to be compiled with CONFIG_BT_CTLR_PERIPHERAL_ISO or CONFIG_BT_CTLR_CENTRAL_ISO (Bluetooth LE isochronous/CIS support) - if neither is enabled, the vulnerable code in ull_llcp_cc.c is not compiled in and the device is not affected. The attacker must be within Bluetooth LE radio range (AV:A) and able to establish an unauthenticated, unencrypted ACL link; no pairing, encryption, or user interaction is needed (PR:N/UI:N). The device must be mid-CIS-Create: against a peripheral, the attacker sends a valid LL_CIS_REQ and then injects any unrelated LL Control PDU (e.g. LL_VERSION_IND) before the Host replies; against a central performing a CIS Create, a malicious peripheral must respond to the CIS_REQ with LL_UNKNOWN_RSP. Limiting factors: proximity requirement confines attacks to physically nearby devices (no remote/internet exploitation), and devices not using Bluetooth ISO are entirely unaffected. In default builds (CONFIG_BT_CTLR_ASSERT_DEBUG=y) a single PDU causes an immediate fatal assertion/reset; with assertions disabled, repeated connect-attack-reconnect cycles are needed to exhaust the LL notification pool (LL_PDU_RX_CNT = 2 * CONFIG_BT_CTLR_LLCP_CONN).

This is a genuine but bounded availability issue, not a high-priority emergency. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 6.5) is internally consistent with the description: exploitation is over-the-air within Bluetooth radio range (Adjacent, not Network), requires no pairing/encryption (PR:N) and no user interaction, is low-complexity (a single injected LL Control PDU), and impacts availability only (C:N/I:N) - matching the CWE-401 memory-leak/DoS nature. No EPSS score, KEV listing, or public POC was provided; per the precision rules this is 'no public exploit identified at time of analysis.' SSVC-style reading: technical impact is partial (DoS/reboot, no code execution or data exposure), and while the trigger is mechanically simple, it is NOT automatable at scale because AV:A confines each attack to devices in physical radio proximity - ruling out internet-wide mass exploitation. The one nuance worth flagging: default builds (CONFIG_BT_CTLR_ASSERT_DEBUG=y) fault and reset on the FIRST injected PDU, so the realistic default-config impact is an instant assertion-driven reboot rather than the slower pool-exhaustion path described for assertion-disabled builds. Overall: a legitimate, patch-worthy DoS against Bluetooth-ISO-enabled Zephyr devices in proximity, but not a widespread or remotely-mass-exploitable threat.

An attacker within Bluetooth radio range of a Zephyr device built with CIS/isochronous support connects over an unauthenticated, unencrypted ACL link and initiates or responds to a CIS Create exchange. Against a peripheral they send a valid LL_CIS_REQ then, before the Host replies, inject any unrelated LL Control PDU (e.g. LL_VERSION_IND); against a central they answer the CIS_REQ with LL_UNKNOWN_RSP. In default builds the retained-node assertion fires immediately, producing a controller fatal error and system reset from that single injected PDU. No public exploit code is identified, though the vendor's regression tests demonstrate the exact trigger.