CVE-2026-10651

Name of the Vulnerable Software and Affected Versions Zephyr (affected versions not specified)

Description A malformed Bluetooth Classic Service Discovery Protocol (SDP) attribute can trigger a reachable assertion in the SDP parser. In the file subsys/bluetooth/host/classic/sdp.c, the function bt sdp parse attribute() accepts an input buffer containing a 1-byte attribute type and 2-byte attribute id, but fails to verify the presence of a byte for the value type before attempting to pull it. A truncated 3-byte attribute can cause net buf simple pull() to be called with insufficient remaining length. In builds with assertions enabled, this triggers a kernel panic, resulting in a denial of service. In builds where assertions are disabled, this may lead to an out-of-bounds read and undefined behavior.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.