CVE-2026-10658: memory-safety in zephyrproject zephyr
bt_iso_recv() in subsys/bluetooth/host/iso.c pulled the ISO SDU header (4 bytes) or, when the timestamp flag is set, the timestamped SDU header (8 bytes) from the inbound HCI ISO Data buffer via net_buf_pull_mem() without first checking buf->len. The upstream hci_iso() handler enforces buf->len == the controller-declared ISO Data_Load length, so a malicious or buggy controller / adjacent BLE peer on an established CIS/BIS can present a first-fragment (BT_ISO_START) or single (BT_ISO_SINGLE) PDU shorter than the SDU header. Because net_buf_simple_pull_mem only guards length with __ASSERT_NO_MSG (compiled out when CONFIG_ASSERT is disabled, the production default), the pull underflows buf->len (uint16_t, e.g. 0 - 8 = 0xFFF8) and advances buf->data past valid data: the subsequent reads of hdr->slen and hdr->sn are out-of-bounds reads of adjacent pool memory. For the multi-fragment (START) case the corrupted buffer is retained as iso->rx, and a following CONT/END fragment's net_buf_tailroom() guard underflows to a near-SIZE_MAX value, defeating the bounds check and causing net_buf_add_mem() to memcpy attacker-supplied fragment data far past the RX pool buffer (out-of-bounds write). The flaw affects ISO receive builds (CONFIG_BT_ISO_RX, selected by the default-off LE Audio options BT_ISO_PERIPHERAL/BT_ISO_CENTRAL/BT_ISO_SYNC_RECEIVER) and has existed since the ISO subsystem was introduced (v2.6.0) through v4.4.0. The fix adds explicit buf->len < sizeof(ts_hdr) and buf->len < sizeof(hdr) checks that drop the buffer before pulling.
AI Analysis
Technical Summary
CVE-2026-10658 describes a memory safety issue in Zephyr's Bluetooth ISO receive code (subsys/bluetooth/host/iso.c). The function bt_iso_recv() pulls ISO SDU headers from an inbound HCI ISO Data buffer without verifying that the buffer length is sufficient, relying instead on an upstream handler's length enforcement. If a malicious or buggy Bluetooth controller or peer sends a fragment shorter than expected, this leads to underflow in buffer length calculations and out-of-bounds memory access. Specifically, out-of-bounds reads occur when accessing header fields, and out-of-bounds writes can occur during multi-fragment reassembly due to corrupted buffer metadata. This affects ISO receive builds enabled by certain LE Audio options and has existed since version 2.6.0 through 4.4.0. The patch adds explicit buffer length checks before pulling header data to drop invalid buffers and prevent underflow.
Potential Impact
The vulnerability allows an attacker controlling a Bluetooth Low Energy (BLE) controller or adjacent peer on an established CIS/BIS connection to cause out-of-bounds memory reads and writes in the Zephyr Bluetooth ISO receive path. This can lead to memory corruption, potentially causing denial of service or system instability. Confidentiality impact is limited (low), as the flaw does not directly disclose sensitive data, but availability impact is high due to possible memory corruption and crashes.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The upstream fix involves adding explicit buffer length checks to drop malformed buffers before processing. Until a patch is applied, avoid enabling ISO receive features (CONFIG_BT_ISO_RX) or the related LE Audio options (BT_ISO_PERIPHERAL, BT_ISO_CENTRAL, BT_ISO_SYNC_RECEIVER) if possible. Monitor vendor communications for official patches or updates.
CVE-2026-10658: memory-safety in zephyrproject zephyr
Description
bt_iso_recv() in subsys/bluetooth/host/iso.c pulled the ISO SDU header (4 bytes) or, when the timestamp flag is set, the timestamped SDU header (8 bytes) from the inbound HCI ISO Data buffer via net_buf_pull_mem() without first checking buf->len. The upstream hci_iso() handler enforces buf->len == the controller-declared ISO Data_Load length, so a malicious or buggy controller / adjacent BLE peer on an established CIS/BIS can present a first-fragment (BT_ISO_START) or single (BT_ISO_SINGLE) PDU shorter than the SDU header. Because net_buf_simple_pull_mem only guards length with __ASSERT_NO_MSG (compiled out when CONFIG_ASSERT is disabled, the production default), the pull underflows buf->len (uint16_t, e.g. 0 - 8 = 0xFFF8) and advances buf->data past valid data: the subsequent reads of hdr->slen and hdr->sn are out-of-bounds reads of adjacent pool memory. For the multi-fragment (START) case the corrupted buffer is retained as iso->rx, and a following CONT/END fragment's net_buf_tailroom() guard underflows to a near-SIZE_MAX value, defeating the bounds check and causing net_buf_add_mem() to memcpy attacker-supplied fragment data far past the RX pool buffer (out-of-bounds write). The flaw affects ISO receive builds (CONFIG_BT_ISO_RX, selected by the default-off LE Audio options BT_ISO_PERIPHERAL/BT_ISO_CENTRAL/BT_ISO_SYNC_RECEIVER) and has existed since the ISO subsystem was introduced (v2.6.0) through v4.4.0. The fix adds explicit buf->len < sizeof(ts_hdr) and buf->len < sizeof(hdr) checks that drop the buffer before pulling.
CVSS v3.1
Score 7.1high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-10658 describes a memory safety issue in Zephyr's Bluetooth ISO receive code (subsys/bluetooth/host/iso.c). The function bt_iso_recv() pulls ISO SDU headers from an inbound HCI ISO Data buffer without verifying that the buffer length is sufficient, relying instead on an upstream handler's length enforcement. If a malicious or buggy Bluetooth controller or peer sends a fragment shorter than expected, this leads to underflow in buffer length calculations and out-of-bounds memory access. Specifically, out-of-bounds reads occur when accessing header fields, and out-of-bounds writes can occur during multi-fragment reassembly due to corrupted buffer metadata. This affects ISO receive builds enabled by certain LE Audio options and has existed since version 2.6.0 through 4.4.0. The patch adds explicit buffer length checks before pulling header data to drop invalid buffers and prevent underflow.
Potential Impact
The vulnerability allows an attacker controlling a Bluetooth Low Energy (BLE) controller or adjacent peer on an established CIS/BIS connection to cause out-of-bounds memory reads and writes in the Zephyr Bluetooth ISO receive path. This can lead to memory corruption, potentially causing denial of service or system instability. Confidentiality impact is limited (low), as the flaw does not directly disclose sensitive data, but availability impact is high due to possible memory corruption and crashes.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The upstream fix involves adding explicit buffer length checks to drop malformed buffers before processing. Until a patch is applied, avoid enabling ISO receive features (CONFIG_BT_ISO_RX) or the related LE Audio options (BT_ISO_PERIPHERAL, BT_ISO_CENTRAL, BT_ISO_SYNC_RECEIVER) if possible. Monitor vendor communications for official patches or updates.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- zephyr
- Date Reserved
- 2026-06-02T15:24:35.422Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a39d22ceed863c81e9d9256
Added to database: 06/23/2026, 00:24:12 UTC
Last enriched: 07/15/2026, 10:48:00 UTC
Last updated: 08/06/2026, 14:49:37 UTC
Views: 130
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.