# CVE-2026-10658: Zephyr OS denial of service in Bluetooth Host ISO receive path

Source: https://junglewise.ai/threats/cve-2026-10658-zephyr-os-denial-of-service-in-bluetooth-host-iso-receive-path  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-23. Updated: 2026-06-23  
License: CC BY 4.0 with a link back

CVE-2026-10658 · Severity: high · CVSS 7.1 · Published 2026-06-23

Zephyr is an open-source operating system designed for resource-constrained IoT devices. A flaw in its Bluetooth software allows a nearby attacker to crash the device by sending specially crafted Bluetooth data. This could lead to a complete service outage for affected smart devices or industrial sensors, and in some cases, might allow unauthorized access to small amounts of memory.

Technologies: [Zephyr Project Zephyr OS](https://junglewise.ai/threats/technologies/zephyr-os). Vendors: [Zephyr Project](https://junglewise.ai/threats/vendors/zephyr-project).

## Quick answers

**Is CVE-2026-10658 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-10658 being exploited in the wild.

**How severe is CVE-2026-10658?** High severity, with a CVSS score of 7.1, published 23 June 2026.

**Which products and versions are affected?** Zephyr Project Zephyr OS <= 4.4.0.

**Is there a fix for CVE-2026-10658?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-10658 attacked?** It is attacked from the adjacent network, in an operating system.

**Am I affected by CVE-2026-10658?** Check whether you run Zephyr Project Zephyr OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in the Zephyr Bluetooth Host ISO receive path within `subsys/bluetooth/host/iso.c`. Specifically, the `bt_iso_recv()` function processes PB=START/SINGLE fragments by pulling SDU headers (4 or 8 bytes) using `net_buf_pull_mem()` without verifying that the buffer contains sufficient data. While the outer `hci_iso()` function validates payload consistency, it does not enforce a minimum size for inner SDU headers. An attacker with the ability to influence HCI data (e.g., via a compromised controller or adjacent Bluetooth traffic) can send a packet with a minimal payload (e.g., 1 byte) to trigger a kernel assertion in builds with asserts enabled, or an out-of-bounds read in non-assert builds. The issue affects configurations with `CONFIG_BT_ISO_RX` enabled.

## Affected products

- Zephyr Project Zephyr OS <= 4.4.0

## Timeline

- 2026-06-21: other: Embargo date
- 2026-06-22: advisory: GitHub Security Advisory published
- 2026-06-23: disclosed: NVD publication date

## References

- [https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-26g8-rmpf-j6cw](https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-26g8-rmpf-j6cw)

## Related threats

- [Zephyr MCTP over USB use-after-free in packet buffer handling](https://junglewise.ai/threats/cve-2026-85032-the-mctp-over-usb-device-class-in-subsys-pmci-mctp-mctp-usb-c)
- [Zephyr arm64 MMU TLB invalidation memory isolation bypass](https://junglewise.ai/threats/cve-2026-79979-the-arm64-mmu-backend-invalidates-a-single-virtual-address-from)
- [Zephyr UpdateHub firmware client NULL pointer dereference in CoAP probe parsing](https://junglewise.ai/threats/cve-2026-76787-the-updatehub-firmware-over-the-air-client-parses-the-coap-probe)
- [CC1200 sub-GHz IEEE 802.15.4 driver buffer overflow in RX packet parsing](https://junglewise.ai/threats/cve-2026-75084-the-cc1200-sub-ghz-ieee-802-15-4-driver-takes-the-phy-packet)
- [Zephyr Bluetooth Link Layer memory leak in connection update](https://junglewise.ai/threats/cve-2026-19739-the-bluetooth-link-layer-control-procedure-code-in-subsys)