The vulnerability occurs in the function bt_sdp_parse_attribute() within Zephyr's Bluetooth Classic SDP parser. The function expects an input buffer containing at least 4 bytes (1-byte attribute type, 2-byte attribute ID, and 1-byte value type). However, it unconditionally reads the value type byte without verifying its presence. If the input is truncated to only 3 bytes, the function calls net_buf_simple_pull() with insufficient buffer length, triggering an assertion failure (__ASSERT_NO_MSG) and causing a kernel panic in builds with assertions enabled. In builds without assertions, the parser may read beyond the buffer boundary, resulting in undefined behavior. This vulnerability can be triggered by a malformed Bluetooth Classic SDP attribute, leading to denial of service or memory safety issues.

Exploitation of this vulnerability can cause a denial of service via a kernel panic in assert-enabled builds of Zephyr. In builds without assertions, it may lead to out-of-bounds memory reads and undefined behavior, potentially compromising system stability or security. The confidentiality impact is limited (partial information disclosure possible), integrity is not impacted, but availability is severely affected due to the denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider disabling Bluetooth Classic SDP parsing if feasible or apply any vendor-recommended temporary mitigations. Monitor the official Zephyr project advisories for updates and apply official fixes once released.