Executive brief
A vulnerability exists in the Zephyr operating system's Bluetooth Classic service discovery component. An attacker within Bluetooth range could send a specially crafted, shortened message that causes the device to crash or restart. This results in a denial of service, potentially disrupting the device's operations and connectivity.
Technical details
A vulnerability in the Bluetooth Classic Service Discovery Protocol (SDP) parser in Zephyr RTOS arises from improper input validation in `bt_sdp_parse_attribute()`. The function verifies the presence of a 1-byte attribute type and 2-byte attribute ID but fails to check for a subsequent mandatory value type byte before attempting to pull it from the buffer. In builds with assertions enabled, a truncated 3-byte attribute triggers a kernel panic via `__ASSERT_NO_MSG`. In builds where assertions are disabled, the parser may perform an out-of-bounds read, potentially leading to information disclosure or undefined behavior. The attack is reachable via the adjacent network (Bluetooth) without authentication. Patches have been merged into the main, v4.4, and v4.3 branches.
Affected products
- Zephyr Project Zephyr <= 4.4.0
Timeline
- 2026-06-14: other: Embargo date
- 2026-06-22: advisory: GitHub advisory published
- 2026-06-23: disclosed: NVD publication date