CVE-2026-10658

Modified Modified - Updated After Analysis

Buffer Overflow in Zephyr Bluetooth Host ISO Receive Path

Publication date: 2026-06-23

Last updated on: 2026-07-14

Assigner: Zephyr Project

Description

bt_iso_recv() in subsys/bluetooth/host/iso.c pulled the ISO SDU header (4 bytes) or, when the timestamp flag is set, the timestamped SDU header (8 bytes) from the inbound HCI ISO Data buffer via net_buf_pull_mem() without first checking buf->len. The upstream hci_iso() handler enforces buf->len == the controller-declared ISO Data_Load length, so a malicious or buggy controller / adjacent BLE peer on an established CIS/BIS can present a first-fragment (BT_ISO_START) or single (BT_ISO_SINGLE) PDU shorter than the SDU header. Because net_buf_simple_pull_mem only guards length with __ASSERT_NO_MSG (compiled out when CONFIG_ASSERT is disabled, the production default), the pull underflows buf->len (uint16_t, e.g. 0 - 8 = 0xFFF8) and advances buf->data past valid data: the subsequent reads of hdr->slen and hdr->sn are out-of-bounds reads of adjacent pool memory. For the multi-fragment (START) case the corrupted buffer is retained as iso->rx, and a following CONT/END fragment's net_buf_tailroom() guard underflows to a near-SIZE_MAX value, defeating the bounds check and causing net_buf_add_mem() to memcpy attacker-supplied fragment data far past the RX pool buffer (out-of-bounds write). The flaw affects ISO receive builds (CONFIG_BT_ISO_RX, selected by the default-off LE Audio options BT_ISO_PERIPHERAL/BT_ISO_CENTRAL/BT_ISO_SYNC_RECEIVER) and has existed since the ISO subsystem was introduced (v2.6.0) through v4.4.0. The fix adds explicit buf->len < sizeof(ts_hdr) and buf->len < sizeof(hdr) checks that drop the buffer before pulling.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-23

Last Modified

2026-07-14

Generated

2026-08-02

AI Q&A

2026-06-23

EPSS Evaluated

2026-08-01

NVD

CVE-2026-10658

Affected Vendors & Products

Vendor	Product	Version / Range
zephyrproject	zephyr	to 4.4.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

CVE-2026-10658 is a vulnerability in the Zephyr RTOS Bluetooth Host ISO receive path. It occurs because the code in the bt_iso_recv() function does not properly check that the data buffer is large enough before pulling header information from Bluetooth HCI ISO data packets. Specifically, when processing certain packet fragments, the function attempts to read header bytes without verifying the buffer length, which can lead to a kernel assert failure or out-of-bounds memory reads.

This happens because malformed or maliciously crafted HCI ISO data with insufficient payload length can bypass outer length checks and cause the system to crash or behave unpredictably.

Detection Guidance

This vulnerability is triggered by malformed Bluetooth HCI ISO data packets with insufficient payload length that cause kernel asserts or out-of-bounds reads in the Zephyr Bluetooth Host ISO receive path.

Detection involves monitoring for kernel assert crashes or denial-of-service symptoms related to Bluetooth ISO data processing, especially if CONFIG_BT_ISO_RX is enabled.

Since the issue arises from malformed HCI ISO packets, capturing Bluetooth traffic with tools like 'btmon' or 'hcidump' and analyzing for abnormal or truncated ISO data packets could help identify attempts to exploit this vulnerability.

No specific commands are provided in the available resources for direct detection, but using Bluetooth protocol analyzers to inspect ISO data length consistency and kernel logs for assert failures related to bt_iso_recv() would be advisable.

Impact Analysis

This vulnerability can lead to a denial of service (DoS) condition by causing the system to crash through a kernel assert failure when processing malformed Bluetooth ISO data. In builds without assert enabled, it may cause out-of-bounds memory reads, potentially leading to undefined behavior or system instability.

An attacker within Bluetooth range could exploit this vulnerability to remotely crash devices running affected versions of Zephyr RTOS with CONFIG_BT_ISO_RX enabled, impacting system availability.

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Mitigation Strategies

Immediate mitigation involves applying the patches that have been merged into the Zephyr main and maintenance branches (v4.4, v4.3, v3.7) which fix the missing length validation in bt_iso_recv().

If patching is not immediately possible, disabling the CONFIG_BT_ISO_RX feature in the Zephyr Bluetooth Host configuration can prevent the vulnerable code path from being used.

Additionally, restricting Bluetooth access to trusted devices and monitoring for unusual Bluetooth ISO traffic can reduce the risk of exploitation.

Hi! I’m here to help you understand CVE-2026-10658. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70