{"id":"CVE-2026-10658","title":"A missing length validation in the Zephyr Bluetooth Host ISO receive path can be triggered by malformed HCI ISO data","summary":"A missing length validation in the Zephyr Bluetooth Host ISO receive path can be triggered by malformed HCI ISO data. In bt_iso_recv() (subsys/bluetooth/host/iso.c), when processing PB=START/SINGLE fragments, the code pulls a TS SDU head…","severity":"high","cvss":7.1,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","cwe":["CWE-125"],"vendor":"zephyrproject","product":"zephyr","affected":["zephyr <= 4.4.1"],"published":"2026-06-23","updated":"2026-07-06","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-10658","references":[{"url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-26g8-rmpf-j6cw","label":"vulnerabilities@zephyrproject.org"}],"tags":["nvd"],"epss":0.00282,"epssPercentile":0.20903,"ingestedAt":"2026-07-06T19:45:46.945Z","slug":"CVE-2026-10658","body":"## Overview\n\nA missing length validation in the Zephyr Bluetooth Host ISO receive path can be triggered by malformed HCI ISO data. In bt_iso_recv() (subsys/bluetooth/host/iso.c), when processing PB=START/SINGLE fragments, the code pulls a TS SDU header (8 bytes, ts=1) or a non-TS SDU header (4 bytes, ts=0) without first verifying that buf->len contains at least that many bytes. The outer HCI ISO length check in hci_iso() validates payload length consistency but not the minimum inner SDU header size, so a packet with payload length 1 passes hci_iso() and then reaches net_buf_pull_mem(), which asserts buf->len >= len. As a result, malformed ISO traffic deterministically triggers a kernel assert (denial of service) in assert-enabled builds, and in non-assert builds the same path may proceed with an undersized buffer, leading to out-of-bounds read behavior. The issue affects products using the Zephyr Host with CONFIG_BT_ISO_RX enabled, particularly where incoming HCI data can be influenced by a malicious or compromised controller or malformed forwarded ISO traffic.\n\n## Affected\n\n- `zephyr <= 4.4.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":39.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}