CVE-2026-9263 is a vulnerability in the Zephyr Bluetooth controller ISO Adaptation Layer (isoal.c) where the length field of a framed ISO PDU start segment is not properly validated. According to the Bluetooth specification, a start segment must have a segment-header length of at least 3 bytes. The function isoal_check_seg_header() incorrectly accepts start segments with length less than 3, causing isoal_rx_framed_consume() to underflow when computing length, resulting in an oversized length value (253-255). This oversized length is then used in isoal_rx_append_to_sdu() to copy memory beyond the received PDU, leading to an out-of-bounds read. The vulnerability can be triggered remotely by a Bluetooth peer or broadcaster via CIS and BIS-sync HCI data paths. The flaw affects all Zephyr releases since version 3.3.0 up to but not including 4.5.0. The fix rejects start segments with length less than 3 and adds a guard before subtraction to prevent underflow.

An attacker controlling Bluetooth ISO PDU start segments can cause the Zephyr Bluetooth controller to read memory out-of-bounds and copy up to approximately 255 bytes beyond the intended buffer into HCI ISO data packets. This can lead to information disclosure to the host and potential denial of service through faults or malformed oversized packets. The vulnerability is exploitable remotely over the air via Bluetooth connections, affecting confidentiality and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor has implemented a fix that rejects start segments with length less than 3 and adds bounds checking to prevent underflow. Users should monitor official Zephyr project advisories for updates and apply the fix once available. Until then, consider restricting or monitoring Bluetooth ISO data traffic from untrusted sources if feasible.