CVE-2026-10658: Zephyr Bluetooth ISO Buffer Underflow Memory Corruption

Technical summary

The bt_iso_recv() function in subsys/bluetooth/host/iso.c performs unsafe buffer operations on ISO SDU headers without pre-validation. The function uses net_buf_pull_mem() to extract a 4-byte header (or 8-byte timestamped header) from an HCI ISO Data buffer without first asserting that buf->len is sufficient. When CONFIG_ASSERT is disabled (production default), the assertion in net_buf_simple_pull_mem() is compiled out, causing the pull operation to underflow the uint16_t len field (e.g., 0 - 8 = 0xFFF8). This advances buf->data into adjacent pool memory, leading to out-of-bounds reads when the corrupted hdr->slen and hdr->sn fields are dereferenced. For multi-fragment PDUs (BT_ISO_START), the corrupted buffer is retained as iso->rx; subsequent CONT/END fragments trigger a net_buf_tailroom() underflow that bypasses the bounds check in net_buf_add_mem(), enabling memcpy of attacker-supplied data far beyond the RX pool buffer. The fix adds explicit length checks (buf->len < sizeof(hdr) and buf->len < sizeof(ts_hdr)) before pulling, dropping invalid packets.

Business impact

This vulnerability creates a risk of memory corruption within Zephyr-based Bluetooth devices and gateways. An attacker with proximity to a vulnerable device and an established CIS (Connected Isochronous Stream) or BIS (Broadcast Isochronous Stream) connection can trigger out-of-bounds reads to leak sensitive data from adjacent memory regions, or craft multi-fragment attacks to overwrite heap or stack memory. The impact depends on the device's architecture and what adjacent memory contains—on embedded systems with tightly-packed pools, this could lead to corruption of other Bluetooth data structures, network state, or security material. LE Audio applications (which commonly enable ISO receive) and mesh/IoT deployments using Zephyr are at elevated risk. Availability impact is high because malformed packets can crash the Bluetooth subsystem.

Affected systems

Zephyr Project versions 2.6.0 through 4.4.0 with CONFIG_BT_ISO_RX enabled (a configuration selected by default when BT_ISO_PERIPHERAL, BT_ISO_CENTRAL, or BT_ISO_SYNC_RECEIVER is enabled). This includes LE Audio stacks, mesh relay nodes, and any Bluetooth peripheral or gateway using Zephyr's ISO receive capabilities. Systems with CONFIG_ASSERT enabled are protected by runtime assertions, but production builds typically disable this. IoT devices, hearing aids, medical sensors, and audio accessories using Zephyr with LE Audio are primary targets.

Exploitability

Exploitation requires network proximity and an established ISO connection (CIS or BIS). The attack is not user-initiated; a malicious or malfunctioning Bluetooth peer can trigger the vulnerability by sending specially-crafted PDU fragments. No user interaction or elevated privileges are required. The low complexity and absence of authentication barriers make this practical for an attacker with Bluetooth range to the target device. The constraint is that an ISO stream must already be negotiated, which limits the attack surface but is standard for LE Audio and other ISO use cases.

Remediation

Update to Zephyr version 4.5.0 or later, which includes explicit length validation before header extraction in bt_iso_recv(). For versions 4.4.0 and earlier, backport the fix by adding buf->len checks before net_buf_pull_mem() calls in subsys/bluetooth/host/iso.c. Alternatively, disable CONFIG_BT_ISO_RX in production builds if ISO receive is not essential, or enable CONFIG_ASSERT to activate runtime length guards (noting that this incurs a performance cost).

Patch guidance

Verify the patch version against the Zephyr release notes and advisories. The fix is expected in v4.5.0 and later. Backport patches for LTS branches should be validated against the main repository commit that resolved this issue. Organizations using vendored or custom Zephyr builds should apply the buffer length validation checks from the upstream fix to their iso.c implementation.

Detection guidance

Monitor Zephyr device logs for ISO packet drops or assertion failures in bt_iso_recv(). Packet analyzer tools (e.g., Wireshark with Bluetooth dissectors) can help identify malformed ISO PDUs on the air, though the vulnerability is triggered at the device level. Runtime assertions (if enabled) will catch the underflow; enable CONFIG_ASSERT in test and staging environments to validate the issue. Fuzz testing with malformed ISO packet streams can help validate the fix before deployment.

Why prioritize this

HIGH priority due to the combination of memory corruption (out-of-bounds read and write), established connection requirement that is standard for LE Audio, and widespread presence in embedded and IoT deployments. The vulnerability has existed for four major versions (2.6 through 4.4), increasing the likelihood that vulnerable code is in production. Availability risk is significant; integrity and confidentiality risks depend on adjacent memory layout but should not be underestimated in constrained environments.

Risk score, explained

CVSS 3.1 score of 7.1 (HIGH) reflects attack vector Adjacent Network (established BLE connection), low complexity, no privileges required, no user interaction, and scope Unchanged. Confidentiality impact is Low (adjacent memory read), Integrity impact is None (direct write is out-of-bounds but does not corrupt ISO protocol state in the CVSS model), and Availability impact is High (crash via memory corruption). The score appropriately prioritizes availability and the realistic attack surface; the out-of-bounds write capability elevates risk above a purely read-based issue.

Frequently asked questions