CVE-2026-10651: Zephyr Bluetooth SDP Parser DoS Vulnerability

CVE-2026-10651 Overview

CVE-2026-10651 is an input validation flaw [CWE-20] in the Zephyr real-time operating system's Bluetooth Classic Service Discovery Protocol (SDP) parser. The function bt_sdp_parse_attribute() in subsys/bluetooth/host/classic/sdp.c accepts an attribute header containing the 1-byte attribute type and 2-byte attribute id, then pulls an additional byte for the value type without verifying that the byte exists in the buffer. An adjacent-network attacker can send a malformed 3-byte SDP attribute to crash the device or trigger an out-of-bounds read.

Critical Impact
A remote attacker on the local Bluetooth radio range can cause a kernel panic (denial of service) on Zephyr devices, or trigger an out-of-bounds read with undefined behavior in builds where assertions are disabled.

Affected Products

Zephyr Project RTOS — Bluetooth Classic host stack (subsys/bluetooth/host/classic/sdp.c)
Devices exposing a Bluetooth Classic SDP server built on Zephyr
Builds with __ASSERT_NO_MSG enabled (panic) and builds with assertions disabled (out-of-bounds read)

Discovery Timeline

2026-06-23 - CVE-2026-10651 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-10651

Vulnerability Analysis

The Zephyr SDP parser processes attribute records that begin with a 1-byte attribute type followed by a 2-byte attribute identifier. After consuming these three bytes, bt_sdp_parse_attribute() calls net_buf_simple_pull() to read the next byte representing the value type. The parser does not check that a fourth byte remains in the network buffer before performing the pull.

A crafted SDP request carrying a truncated attribute such as the 3-byte sequence 09 00 09 causes net_buf_simple_pull() to be invoked with buf->len < len. In assert-enabled builds this trips the __ASSERT_NO_MSG(buf->len >= len) guard and panics the kernel. In production builds that disable assertions, the function continues past the end of the buffer, producing an out-of-bounds read of adjacent memory.

Root Cause

The root cause is missing length validation before consuming buffer bytes [CWE-20]. The parser validates the presence of the 3-byte attribute header but assumes the value-type byte is also present without an explicit bounds check. The single __ASSERT_NO_MSG inside net_buf_simple_pull() is the only barrier, and it converts a logic bug into a denial-of-service primitive rather than safely rejecting the malformed input.

Attack Vector

Exploitation requires Bluetooth radio adjacency to the target. An attacker pairs or connects to the SDP server on an affected Zephyr device and sends an SDP request whose attribute list ends after the attribute identifier, omitting the value type byte. No authentication or user interaction is required to reach the vulnerable parser path. The result is either an immediate kernel panic or undefined behavior driven by attacker-influenced buffer contents.

Detection Methods for CVE-2026-10651

Indicators of Compromise

Unexpected reboots or kernel panics on Bluetooth-enabled Zephyr devices coinciding with inbound Bluetooth Classic activity.
SDP requests carrying attribute records that terminate immediately after the 3-byte attribute header (for example payloads ending in 09 00 09).
Bluetooth log entries referencing assertion failures in bt_sdp_parse_attribute or net_buf_simple_pull.

Detection Strategies

Capture Bluetooth Classic traffic with an over-the-air sniffer and inspect SDP attribute lists for truncated attribute records lacking a value-type byte.
Add fuzzing harnesses around bt_sdp_parse_attribute() to surface additional malformed-input paths during development and regression testing.
Correlate device crash telemetry with proximity of unknown Bluetooth peers to identify radio-range probing.

Monitoring Recommendations

Forward Zephyr device crash logs and Bluetooth subsystem diagnostics into a centralized log platform for assertion-failure pattern matching.
Alert on repeated short-lived SDP sessions from unpaired peers, which can indicate fuzzing or scripted exploitation attempts.
Track firmware versions across fleets so devices still running unpatched Zephyr Bluetooth host builds are visible to security operations.

How to Mitigate CVE-2026-10651

Immediate Actions Required

Upgrade affected Zephyr-based firmware to a release that includes the fix referenced in the Zephyr GitHub Security Advisory GHSA-p93g-3r68-cj53.
Disable Bluetooth Classic and the SDP server on devices that do not require it until patched firmware is deployed.
Audit downstream products that vendor the Zephyr Bluetooth host stack and rebuild them against the patched source.

Patch Information

The Zephyr Project published the fix and full technical details in the GitHub Security Advisory GHSA-p93g-3r68-cj53. The patch adds an explicit remaining-length check in bt_sdp_parse_attribute() before pulling the value-type byte, so malformed attribute records are rejected instead of reaching net_buf_simple_pull().

Workarounds

Restrict Bluetooth Classic discoverability and connectability so untrusted peers cannot reach the SDP server.
Deploy devices in environments with limited radio exposure to reduce the adjacent-network attack surface.
Keep assertion-enabled builds in production where feasible, since a controlled panic is preferable to an out-of-bounds read with undefined behavior.

bash

# Disable Bluetooth Classic SDP in Zephyr prj.conf until patched firmware is available
CONFIG_BT_CLASSIC=n
CONFIG_BT_BREDR=n
CONFIG_BT_RFCOMM=n