CVE-2026-10658

Name of the Vulnerable Software and Affected Versions Zephyr (affected versions not specified)

Description A missing length validation in the Bluetooth Host ISO receive path can be triggered by malformed HCI ISO data. In the bt iso recv() function (subsys/bluetooth/host/iso.c), when processing PB=START/SINGLE fragments, the system attempts to pull a TS SDU header (8 bytes, ts=1) or a non-TS SDU header (4 bytes, ts=0) without verifying that buf->len contains the required minimum bytes. While the outer HCI ISO length check in hci iso() validates payload length consistency, it does not verify the minimum inner SDU header size. Consequently, a packet with a payload length of 1 can pass hci iso() and reach net buf pull mem(), which requires buf->len to be greater than or equal to the requested length. This leads to a kernel assert and denial of service in assert-enabled builds, or out-of-bounds read behavior in non-assert builds. This issue affects products using the Zephyr Host with CONFIG BT ISO RX enabled, especially when incoming HCI data is influenced by a compromised controller or malformed forwarded ISO traffic.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.