CVE-2026-10658 zephyrproject-rtos CVE debrief

Who should care

Organizations using the Zephyr Host with CONFIG_BT_ISO_RX enabled should be aware of this vulnerability. This includes products where incoming HCI data can be influenced by a malicious or compromised controller or malformed forwarded ISO traffic. The vulnerability can lead to a denial of service and potential out-of-bounds read behavior.

Technical summary

The vulnerability is caused by a missing length validation in the Zephyr Bluetooth Host ISO receive path. Specifically, in the bt_iso_recv() function (subsys/bluetooth/host/iso.c), the code pulls a TS SDU header (8 bytes, ts=1) or a non-TS SDU header (4 bytes, ts=0) without first verifying that buf->len contains at least that many bytes. The outer HCI ISO length check in hci_iso() validates payload length consistency but not the minimum inner SDU header size. As a result, malformed ISO traffic can deterministically trigger a kernel assert (denial of service) in assert-enabled builds, and in non-assert builds, the same path may proceed with an undersized buffer, leading to out-of-bounds read behavior.

Defensive priority

High priority should be given to patching this vulnerability, as it can lead to a denial of service and potential out-of-bounds read behavior. Organizations should prioritize patching systems using the Zephyr Host with CONFIG_BT_ISO_RX enabled.

Recommended defensive actions

• Patch systems using the Zephyr Host with CONFIG_BT_ISO_RX enabled.
• Verify and update HCI data validation to prevent malformed ISO traffic.
• Monitor for and respond to potential denial of service and out-of-bounds read behavior.
• Review and update incident response plans to address potential exploitation.
• Perform thorough vulnerability assessments to identify affected systems.

Evidence notes

The CVE-2026-10658 vulnerability is based on information from the NVD and Zephyr project sources. The vulnerability affects products using the Zephyr Host with CONFIG_BT_ISO_RX enabled. Evidence is limited to official CVE and NVD records, as well as a Zephyr project advisory.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.