CVE-2026-9263: Zephyr Bluetooth ISO Information Disclosure

CVE-2026-9263 Overview

CVE-2026-9263 is an out-of-bounds read [CWE-125] in the Zephyr real-time operating system Bluetooth controller's ISO Adaptation Layer (ISOAL). The vulnerability resides in subsys/bluetooth/controller/ll_sw/isoal.c and stems from missing length validation of framed ISO Protocol Data Unit (PDU) start segments. An attacker within Bluetooth range can send crafted framed ISO PDUs to trigger a uint8_t underflow, causing up to 255 bytes of controller memory beyond the received PDU to be copied into a Host Controller Interface (HCI) ISO data packet and delivered to the host. All Zephyr releases since v3.0.0 are affected.

Critical Impact
Remote attackers within Bluetooth Adjacent Network range can leak up to 255 bytes of controller memory per malformed PDU through both Connected Isochronous Stream (CIS) and Broadcast Isochronous Stream (BIS) sync data paths, enabling information disclosure and potential denial of service.

Affected Products

Zephyr RTOS v3.0.0 and later (all releases since framed ISO reception was introduced)
Devices using the Zephyr Bluetooth controller with CIS or BIS-sync HCI data paths
Devices using the Zephyr vendor data path in ull_iso.c

Discovery Timeline

2026-06-30 - CVE-2026-9263 published to the National Vulnerability Database
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-9263

Vulnerability Analysis

The Zephyr Bluetooth controller processes framed ISO PDUs through isoal_check_seg_header() and isoal_rx_framed_consume(). Per the Bluetooth specification, a start segment identified by sc=0 always carries a 3-byte time_offset field. Its segment-header len must therefore be at least PDU_ISO_SEG_TIMEOFFSET_SIZE (3 bytes).

The validator accepted start segments with len < 3 as valid. The consumer then computed length = seg_hdr->len - 3 in a uint8_t, underflowing to 253-255 when len was 0, 1, or 2. This oversized length reached isoal_rx_append_to_sdu(), which clamped the copy only against the destination Service Data Unit (SDU) buffer size, not the source PDU length.

The result is an out-of-bounds read where up to approximately 255 bytes of controller memory beyond the received PDU are copied via sink_sdu_write_hci() and net_buf_add_mem() into an HCI ISO data packet delivered to the host.

Root Cause

The root cause is a missing precondition check combined with an unchecked unsigned subtraction. isoal_check_seg_header() did not enforce the specification-mandated minimum length for start segments, and isoal_rx_framed_consume() performed seg_hdr->len - 3 on a uint8_t without validating the operand, producing wraparound values of 253-255.

Attack Vector

The PDU and its segment headers are entirely attacker-controlled and arrive over the air. A remote CIS peer or a broadcaster the device is synced to via BIS can send malformed framed ISO PDUs. Reachable paths include hci_driver.c for both CIS and BIS-sync and ull_iso.c for the vendor data path. Successful exploitation leaks controller memory to the host and can cause faults or malformed oversized HCI ISO packets, resulting in denial of service.

// Patch from subsys/bluetooth/controller/ll_sw/isoal.c
 	if (pdu_size_remaining >= PDU_ISO_SEG_HDR_SIZE &&
 		pdu_size_remaining >= PDU_ISO_SEG_HDR_SIZE + seg_hdr->len) {
 
+		if ((seg_hdr->sc == 0U) && (seg_hdr->len < PDU_ISO_SEG_TIMEOFFSET_SIZE)) {
+			/* Start segment (sc=0) must contain a time_offset field */
+			return ISOAL_SDU_STATUS_ERRORS;
+		}
+
 		/* Valid if there is sufficient data for the segment header and
 		 * there is sufficient data for the required length of the
 		 * segment

Source: Zephyr Commit 28080d80

Detection Methods for CVE-2026-9263

Indicators of Compromise

Unexpectedly large or malformed HCI ISO data packets delivered from the controller to the host, particularly with sizes approaching 255 bytes beyond the negotiated SDU size.
Controller faults, resets, or watchdog events correlated with active CIS connections or BIS synchronization sessions.
Framed ISO PDUs received with start-segment headers where sc=0 and len < 3.

Detection Strategies

Instrument the Bluetooth controller HCI trace to log framed ISO segment headers and flag start segments with len < PDU_ISO_SEG_TIMEOFFSET_SIZE.
Add host-side validation of received HCI ISO packet lengths against the expected SDU size negotiated during CIS or BIS setup.
Monitor for repeated malformed ISO PDU errors from a single remote peer or broadcaster, which may indicate active probing.

Monitoring Recommendations

Enable verbose logging in subsys/bluetooth/controller/ll_sw/isoal.c during development and QA to surface ISOAL_SDU_STATUS_ERRORS events.
Collect over-the-air captures in test environments to correlate malformed segment headers with controller behavior.
Track firmware versions across the device fleet to identify Zephyr builds at or above v3.0.0 that remain unpatched.

How to Mitigate CVE-2026-9263

Immediate Actions Required

Apply the upstream Zephyr fix from commit 28080d80fc8aca30af1dfd1338bd4481b13c7395 to subsys/bluetooth/controller/ll_sw/isoal.c and rebuild affected firmware.
Inventory all Zephyr-based devices using Bluetooth LE Isochronous Channels and prioritize patching for those exposed to untrusted CIS peers or public BIS broadcasters.
Where patching cannot be immediate, disable framed ISO reception and CIS or BIS features in the Zephyr build configuration.

Patch Information

The fix rejects sc=0 segments with len < 3 in isoal_check_seg_header() and adds a guard before the subtraction in isoal_rx_framed_consume(). Details are available in the Zephyr Security Advisory GHSA-6gvp-pmh8-fjh2 and the upstream commit.

Workarounds

Disable ISO framed reception by not enabling CONFIG_BT_CTLR_CONN_ISO and CONFIG_BT_CTLR_SYNC_ISO in unpatched builds where isochronous streams are not required.
Restrict device pairing and broadcast synchronization to trusted peers where feasible to reduce exposure through the Adjacent Network attack vector.
Add host-side length sanity checks on incoming HCI ISO data packets to discard oversized frames before they reach application logic.

bash

# Zephyr build configuration example to disable ISO paths when not required
CONFIG_BT_CTLR_CONN_ISO=n
CONFIG_BT_CTLR_SYNC_ISO=n
CONFIG_BT_ISO_UNICAST=n
CONFIG_BT_ISO_BROADCAST=n