zephyrproject-rtos Zephyr up to 4.4.0 iso.c bt_iso_recv len out-of-bounds

Summaryinfo

A vulnerability categorized as problematic has been discovered in zephyrproject-rtos Zephyr up to 4.4.0. This affects the function bt_iso_recv of the file subsys/bluetooth/host/iso.c. Such manipulation of the argument len leads to out-of-bounds. This vulnerability is uniquely identified as CVE-2026-10658. The attack can only be initiated within the local network. No exploit exists.

Detailsinfo

A vulnerability was found in zephyrproject-rtos Zephyr up to 4.4.0. It has been rated as critical. Affected by this issue is the function bt_iso_recv of the file subsys/bluetooth/host/iso.c. The manipulation of the argument len with an unknown input leads to a out-of-bounds vulnerability. Using CWE to declare the problem leads to CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. Impacted is confidentiality, integrity, and availability. CVE summarizes:

bt_iso_recv() in subsys/bluetooth/host/iso.c pulled the ISO SDU header (4 bytes) or, when the timestamp flag is set, the timestamped SDU header (8 bytes) from the inbound HCI ISO Data buffer via net_buf_pull_mem() without first checking buf->len. The upstream hci_iso() handler enforces buf->len == the controller-declared ISO Data_Load length, so a malicious or buggy controller / adjacent BLE peer on an established CIS/BIS can present a first-fragment (BT_ISO_START) or single (BT_ISO_SINGLE) PDU shorter than the SDU header. Because net_buf_simple_pull_mem only guards length with __ASSERT_NO_MSG (compiled out when CONFIG_ASSERT is disabled, the production default), the pull underflows buf->len (uint16_t, e.g. 0 - 8 = 0xFFF8) and advances buf->data past valid data: the subsequent reads of hdr->slen and hdr->sn are out-of-bounds reads of adjacent pool memory. For the multi-fragment (START) case the corrupted buffer is retained as iso->rx, and a following CONT/END fragment's net_buf_tailroom() guard underflows to a near-SIZE_MAX value, defeating the bounds check and causing net_buf_add_mem() to memcpy attacker-supplied fragment data far past the RX pool buffer (out-of-bounds write). The flaw affects ISO receive builds (CONFIG_BT_ISO_RX, selected by the default-off LE Audio options BT_ISO_PERIPHERAL/BT_ISO_CENTRAL/BT_ISO_SYNC_RECEIVER) and has existed since the ISO subsystem was introduced (v2.6.0) through v4.4.0. The fix adds explicit buf->len < sizeof(ts_hdr) and buf->len < sizeof(hdr) checks that drop the buffer before pulling.

The advisory is available at github.com. This vulnerability is handled as CVE-2026-10658 since 06/02/2026. The exploitation is known to be easy. The attack can only be done within the local network. No form of authentication is required for exploitation. Technical details are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 322298 (Linux Distros Unpatched Vulnerability : CVE-2026-10658), which helps to determine the existence of the flaw in a target environment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Tenable (322298). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Project Management Software

Vendor

• zephyrproject-rtos

Name

• Zephyr

Version

• 4.0
• 4.1
• 4.2
• 4.3
• 4.4.0

License

• open-source

Website

• Product: https://github.com/zephyrproject-rtos/zephyr/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion