CVE-2026-10658: Zephyr Bluetooth Host ISO DoS Vulnerability

CVE-2026-10658 Overview

CVE-2026-10658 is a missing length validation vulnerability in the Zephyr real-time operating system Bluetooth Host Isochronous (ISO) receive path. The flaw exists in bt_iso_recv() within subsys/bluetooth/host/iso.c. When processing PB=START/SINGLE fragments, the function pulls a Service Data Unit (SDU) header without verifying that the buffer contains enough bytes. Malformed Host Controller Interface (HCI) ISO traffic deterministically triggers a kernel assertion in assert-enabled builds. Non-assert builds may proceed with an undersized buffer and perform an out-of-bounds read [CWE-125]. The vulnerability affects products using the Zephyr Host with CONFIG_BT_ISO_RX enabled.

Critical Impact
An adjacent network attacker with a malicious or compromised Bluetooth controller can crash Zephyr-based devices through deterministic denial of service, with potential out-of-bounds memory disclosure in non-assert builds.

Affected Products

Zephyr RTOS Bluetooth Host with CONFIG_BT_ISO_RX enabled
Embedded and IoT devices using the Zephyr Bluetooth ISO receive stack
Systems exposed to malicious or compromised Bluetooth controllers or forwarded ISO traffic

Discovery Timeline

2026-06-23 - CVE-2026-10658 published to the National Vulnerability Database
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-10658

Vulnerability Analysis

The vulnerability resides in the Zephyr Bluetooth Host ISO receive path. The bt_iso_recv() function processes incoming HCI ISO data fragments and extracts the SDU header based on the timestamp flag. When ts=1, the code pulls an 8-byte timestamped SDU header. When ts=0, it pulls a 4-byte non-timestamped header. The function performs neither check before invoking net_buf_pull_mem().

The outer length check in hci_iso() validates HCI payload length consistency. It does not enforce the minimum inner SDU header size. A crafted packet with payload length of 1 byte passes the outer validation and reaches net_buf_pull_mem(). That helper asserts buf->len >= len, which fires the kernel assertion and halts execution.

In builds compiled without assertions, the pull proceeds against an undersized buffer. Subsequent reads access memory beyond the buffer bounds, producing out-of-bounds read behavior classified under [CWE-125].

Root Cause

The root cause is missing bounds validation between two abstraction layers. The HCI dispatcher trusts payload length values without enforcing protocol-specific minimums. The ISO receive handler trusts that the dispatcher has already validated header sizes. Neither layer performs the length check required before pulling SDU header bytes.

Attack Vector

An attacker requires adjacent network access, typically through a malicious or compromised Bluetooth controller paired with the Zephyr Host. Forwarded ISO traffic from a compromised intermediary device can also deliver the malformed packet. No privileges or user interaction are required. The attacker transmits an HCI ISO packet with a START or SINGLE fragment whose payload length is smaller than the required 4-byte or 8-byte SDU header. The Host accepts the packet and triggers the assertion or undersized buffer access.

The vulnerability mechanism is documented in the Zephyr GitHub Security Advisory GHSA-26g8-rmpf-j6cw. No public proof-of-concept exploit code is available at this time.

Detection Methods for CVE-2026-10658

Indicators of Compromise

Unexpected Zephyr device reboots or kernel panic logs referencing net_buf_pull_mem or bt_iso_recv
Repeated Bluetooth stack assertion failures coinciding with ISO traffic
HCI traces showing ISO data packets with payload length values smaller than 4 bytes on PB=START or PB=SINGLE fragments

Detection Strategies

Capture HCI logs and inspect ISO Data packets for malformed SDU headers and undersized payloads
Monitor device crash telemetry and correlate restarts with Bluetooth activity windows
Deploy fuzzing harnesses against the bt_iso_recv() code path during pre-production validation

Monitoring Recommendations

Forward device crash dumps and serial console logs to a centralized logging or SIEM platform for correlation
Track Bluetooth controller-to-host transport events for anomalous ISO fragment patterns
Alert on repeated reboots of fleet devices that share Bluetooth controller firmware revisions

How to Mitigate CVE-2026-10658

Immediate Actions Required

Apply the Zephyr upstream patch referenced in GHSA-26g8-rmpf-j6cw and rebuild affected firmware images
Audit deployed devices for CONFIG_BT_ISO_RX usage and prioritize patching for any system that exposes ISO receive functionality
Restrict pairing and bonding to trusted Bluetooth controllers where feasible

Patch Information

The Zephyr Project has published the fix through the official security advisory at GHSA-26g8-rmpf-j6cw. The fix adds a length check before calling net_buf_pull_mem() in bt_iso_recv() to confirm that buf->len is at least 4 bytes for non-timestamped SDU headers and 8 bytes for timestamped headers. Vendors integrating Zephyr should pull the corrected subsys/bluetooth/host/iso.c into their downstream builds.

Workarounds

Disable CONFIG_BT_ISO_RX in device builds that do not require Bluetooth Isochronous Channel reception
Limit Bluetooth exposure by reducing advertising range and disabling discovery in production deployments
Use a vetted controller firmware that does not forward malformed ISO fragments to the Host

bash

# Disable Bluetooth ISO receive support in Zephyr prj.conf when not required
CONFIG_BT_ISO_RX=n