CVE-2026-9263: Zephyr Bluetooth ISO Adaptation Layer Memory Disclosure

Technical summary

The vulnerability resides in the Zephyr Bluetooth controller's ISO Adaptation Layer (isoal.c), specifically in the handling of framed ISO PDU start segments. According to the Bluetooth specification, start segments (identified by sc=0) must include a 3-byte time_offset field, making the minimum valid segment header length 3 bytes (PDU_ISO_SEG_TIMEOFFSET_SIZE). The isoal_check_seg_header() function fails to enforce this minimum, accepting start segments with len < 3 as valid. When isoal_rx_framed_consume() processes such invalid segments, it executes length = seg_hdr->len - 3 as an unsigned 8-bit integer. For len values of 0, 1, or 2, this subtraction underflows, producing a length of 253, 254, or 255 respectively. This oversized length is then passed to isoal_rx_append_to_sdu(), which copies data into an SDU buffer using only the destination buffer size as a boundary check, not the source PDU length. The result is an out-of-bounds read that copies up to ~255 bytes of adjacent controller memory into HCI ISO data packets. The PDU and segment headers arrive over the air through CIS (Connected Isochronous Stream), BIS-sync (Broadcast Isochronous Stream synchronization), or vendor data paths, all reachable by remote attackers.

Business impact

Organizations deploying Zephyr-based Bluetooth devices—particularly in IoT, wearables, and embedded wireless applications—face information disclosure and potential denial-of-service risks. A remote attacker with Bluetooth range (typically 10–100 meters depending on hardware and power class) can extract sensitive data from device memory without authentication. This could expose encryption keys, session tokens, personal data, or firmware details. Additionally, malformed HCI packets could destabilize the host processing logic, causing faults or crashes. For products in medical, industrial, or critical infrastructure contexts, this poses both confidentiality and availability concerns.

Affected systems

Zephyr versions 3.0.0 through the current release are affected. The flaw is present in any build that includes the Bluetooth controller subsystem with ISO reception enabled (subsys/bluetooth/controller/ll_sw/isoal.c). Devices using Zephyr as a Bluetooth stack—including but not limited to nRF52, STM32, and other ARM-based SoCs—are in scope if they support framed ISO PDU reception. The vulnerability is reachable through both CIS (connected) and BIS (broadcast) HCI data paths and vendor-specific data handlers.

Exploitability

Exploitability is straightforward: an attacker within Bluetooth range crafts an ISO PDU start segment with a length field of 0–2 bytes and transmits it either as a CIS peer or via BIS broadcast. No authentication, user interaction, or special privileges are required on the target device. The attacker's only constraint is physical proximity (Bluetooth range). Proof of concept development is low-effort given the simple length validation bypass. However, reliably triggering information disclosure requires some knowledge of the target device's memory layout to extract meaningful data rather than random bytes.

Remediation

The fix involves two changes to isoal.c: (1) isoal_check_seg_header() must reject start segments (sc=0) with len < PDU_ISO_SEG_TIMEOFFSET_SIZE (3 bytes), and (2) isoal_rx_framed_consume() must add a bounds check before performing the len - 3 subtraction, ensuring the source PDU length is respected. Zephyr maintainers have committed these fixes. Organizations must patch their Zephyr installations and rebuild affected firmware.

Patch guidance

Apply the upstream Zephyr patch that hardens isoal_check_seg_header() to reject undersized start segments and adds guards in isoal_rx_framed_consume(). Verify the fix is present in your Zephyr branch or cherry-pick the commit if using a release branch. Rebuild all affected device firmware and validate over-the-air updates. Test with both CIS and BIS scenarios to ensure framed ISO reception still functions correctly after patching. Consider rolling back to a known-good version if patching is delayed.

Detection guidance

Monitor for HCI ISO data packets with unexpectedly large payloads or unusual memory patterns. Devices with packet capture capability can inspect incoming ISO PDUs for malformed start segments (len < 3). Enable debug logging in isoal_rx_framed_consume() if available to identify dropped or corrected frames. Watch for device crashes or firmware faults triggered by malformed HCI packets, which may indicate exploitation attempts. BLE analyzers (e.g., Wireshark with BLE dissectors) can identify crafted ISO frames from untrusted sources.

Why prioritize this

Although the CVSS score is 6.5 (MEDIUM), the vulnerability warrants prompt attention due to its attack surface (remote, no authentication) and impact on confidentiality. Information disclosure from device memory could expose cryptographic material or private user data. The presence of an integer underflow bug in a widely deployed Bluetooth subsystem increases the likelihood of secondary exploitation. Devices in production should be prioritized if they handle sensitive data or operate in security-critical environments.

Risk score, explained

CVSS 3.1 score of 6.5 (MEDIUM) reflects: Attack Vector Adjacent (Bluetooth range requirement), Access Complexity Low (straightforward length bypass), Privileges Required None, User Interaction None, Scope Unchanged, Confidentiality Impact High (arbitrary memory read), Integrity None, Availability None (though DoS is possible via malformed packets, it is not captured in the base score). The score does not account for the absence of active exploitation in the wild or the simplicity of the fix, both of which argue for prioritization alongside other remediation efforts.

Frequently asked questions