Executive brief
Zephyr is an open-source operating system designed for resource-constrained IoT devices. A flaw in its Bluetooth software allows a nearby attacker to crash the device by sending specially crafted Bluetooth data. This could lead to a complete service outage for affected smart devices or industrial sensors, and in some cases, might allow unauthorized access to small amounts of memory.
Technical details
A vulnerability exists in the Zephyr Bluetooth Host ISO receive path within `subsys/bluetooth/host/iso.c`. Specifically, the `bt_iso_recv()` function processes PB=START/SINGLE fragments by pulling SDU headers (4 or 8 bytes) using `net_buf_pull_mem()` without verifying that the buffer contains sufficient data. While the outer `hci_iso()` function validates payload consistency, it does not enforce a minimum size for inner SDU headers. An attacker with the ability to influence HCI data (e.g., via a compromised controller or adjacent Bluetooth traffic) can send a packet with a minimal payload (e.g., 1 byte) to trigger a kernel assertion in builds with asserts enabled, or an out-of-bounds read in non-assert builds. The issue affects configurations with `CONFIG_BT_ISO_RX` enabled.
Affected products
- Zephyr Project Zephyr OS <= 4.4.0
Timeline
- 2026-06-21: other: Embargo date
- 2026-06-22: advisory: GitHub Security Advisory published
- 2026-06-23: disclosed: NVD publication date