The Zephyr Bluetooth controller ISO Adaptation Layer (isoal.c) fails to properly validate the length field of a framed ISO PDU start segment. According to the Bluetooth specification, a start segment (sc=0) must have a segment-header length of at least 3 bytes to carry the time_offset. The function isoal_check_seg_header() incorrectly accepts start segments with length less than 3 as valid. Consequently, isoal_rx_framed_consume() computes a length by subtracting 3 from the segment length in a uint8_t, causing underflow when length is 0-2. This results in an oversized length (253-255) passed to isoal_rx_append_to_sdu(), which copies data beyond the received PDU buffer into an HCI ISO data packet delivered to the host. Since the PDU and segment headers are attacker-controlled and arrive over the air via multiple HCI data paths, a remote attacker can trigger out-of-bounds reads causing information disclosure and potential denial of service. The vulnerability affects all Zephyr versions since framed ISO reception was introduced in v3.0.0. The fix involves rejecting start segments with length less than 3 and adding a guard before the subtraction in isoal_rx_framed_consume().

An attacker controlling Bluetooth ISO PDUs can cause out-of-bounds reads in the Zephyr Bluetooth controller, leading to information disclosure to the host and potential denial of service through faults or malformed oversized HCI ISO packets. The vulnerability does not affect integrity or availability beyond denial of service and does not require privileges or user interaction. The CVSS score is 6.5 (medium severity) with attack vector over the air and low attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix rejects invalid start segments and adds bounds checks to prevent underflow and out-of-bounds reads. Until an official patch is available, consider restricting Bluetooth ISO usage or applying vendor-provided mitigations if any.