zephyrproject-rtos Zephyr up to 4.4.0 iso.c bt_iso_recv len out-of-bounds

Summaryinfo

A vulnerability categorized as problematic has been discovered in zephyrproject-rtos Zephyr up to 4.4.0. This affects the function bt_iso_recv of the file subsys/bluetooth/host/iso.c. Such manipulation of the argument len leads to out-of-bounds. This vulnerability is uniquely identified as CVE-2026-10658. The attack can only be initiated within the local network. No exploit exists.

Detailsinfo

A vulnerability was found in zephyrproject-rtos Zephyr up to 4.4.0. It has been rated as critical. Affected by this issue is the function bt_iso_recv of the file subsys/bluetooth/host/iso.c. The manipulation of the argument len with an unknown input leads to a out-of-bounds vulnerability. Using CWE to declare the problem leads to CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. Impacted is confidentiality, integrity, and availability. CVE summarizes:

A missing length validation in the Zephyr Bluetooth Host ISO receive path can be triggered by malformed HCI ISO data. In bt_iso_recv() (subsys/bluetooth/host/iso.c), when processing PB=START/SINGLE fragments, the code pulls a TS SDU header (8 bytes, ts=1) or a non-TS SDU header (4 bytes, ts=0) without first verifying that buf->len contains at least that many bytes. The outer HCI ISO length check in hci_iso() validates payload length consistency but not the minimum inner SDU header size, so a packet with payload length 1 passes hci_iso() and then reaches net_buf_pull_mem(), which asserts buf->len >= len. As a result, malformed ISO traffic deterministically triggers a kernel assert (denial of service) in assert-enabled builds, and in non-assert builds the same path may proceed with an undersized buffer, leading to out-of-bounds read behavior. The issue affects products using the Zephyr Host with CONFIG_BT_ISO_RX enabled, particularly where incoming HCI data can be influenced by a malicious or compromised controller or malformed forwarded ISO traffic.

The advisory is available at github.com. This vulnerability is handled as CVE-2026-10658 since 06/02/2026. The exploitation is known to be easy. The attack can only be done within the local network. No form of authentication is required for exploitation. Technical details are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 322298 (Linux Distros Unpatched Vulnerability : CVE-2026-10658), which helps to determine the existence of the flaw in a target environment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Tenable (322298). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Project Management Software

Vendor

• zephyrproject-rtos

Name

• Zephyr

Version

• 4.0
• 4.1
• 4.2
• 4.3
• 4.4.0

License

• open-source

Website

• Product: https://github.com/zephyrproject-rtos/zephyr/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion