{"id":"UBUNTU-CVE-2026-10658","details":"bt_iso_recv() in subsys/bluetooth/host/iso.c pulled the ISO SDU header (4 bytes) or, when the timestamp flag is set, the timestamped SDU header (8 bytes) from the inbound HCI ISO Data buffer via net_buf_pull_mem() without first checking buf-\u003elen. The upstream hci_iso() handler enforces buf-\u003elen == the controller-declared ISO Data_Load length, so a malicious or buggy controller / adjacent BLE peer on an established CIS/BIS can present a first-fragment (BT_ISO_START) or single (BT_ISO_SINGLE) PDU shorter than the SDU header. Because net_buf_simple_pull_mem only guards length with __ASSERT_NO_MSG (compiled out when CONFIG_ASSERT is disabled, the production default), the pull underflows buf-\u003elen (uint16_t, e.g. 0 - 8 = 0xFFF8) and advances buf-\u003edata past valid data: the subsequent reads of hdr-\u003eslen and hdr-\u003esn are out-of-bounds reads of adjacent pool memory. For the multi-fragment (START) case the corrupted buffer is retained as iso-\u003erx, and a following CONT/END fragment's net_buf_tailroom() guard underflows to a near-SIZE_MAX value, defeating the bounds check and causing net_buf_add_mem() to memcpy attacker-supplied fragment data far past the RX pool buffer (out-of-bounds write). The flaw affects ISO receive builds (CONFIG_BT_ISO_RX, selected by the default-off LE Audio options BT_ISO_PERIPHERAL/BT_ISO_CENTRAL/BT_ISO_SYNC_RECEIVER) and has existed since the ISO subsystem was introduced (v2.6.0) through v4.4.0. The fix adds explicit buf-\u003elen \u003c sizeof(ts_hdr) and buf-\u003elen \u003c sizeof(hdr) checks that drop the buffer before pulling.","modified":"2026-07-15T19:45:58.034061232Z","published":"2026-06-23T01:16:00Z","upstream":["CVE-2026-10658"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-10658"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-10658"},{"type":"REPORT","url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-26g8-rmpf-j6cw"}],"affected":[{"package":{"name":"zephyr","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/zephyr?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.2-1","3.1.2-1build1"],"ecosystem_specific":{"binaries":[{"binary_name":"libzephyr4","binary_version":"3.1.2-1build1"},{"binary_name":"libzephyr4-krb5","binary_version":"3.1.2-1build1"},{"binary_version":"3.1.2-1build1","binary_name":"zephyr-clients"},{"binary_name":"zephyr-server","binary_version":"3.1.2-1build1"},{"binary_name":"zephyr-server-krb5","binary_version":"3.1.2-1build1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-10658.json"}},{"package":{"name":"zephyr","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/zephyr?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.2-1build1","3.1.2-1build2"],"ecosystem_specific":{"binaries":[{"binary_version":"3.1.2-1build2","binary_name":"libzephyr4"},{"binary_name":"libzephyr4-krb5","binary_version":"3.1.2-1build2"},{"binary_name":"zephyr-clients","binary_version":"3.1.2-1build2"},{"binary_version":"3.1.2-1build2","binary_name":"zephyr-server"},{"binary_name":"zephyr-server-krb5","binary_version":"3.1.2-1build2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-10658.json"}},{"package":{"name":"zephyr","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/zephyr?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.2-1build3"],"ecosystem_specific":{"binaries":[{"binary_name":"libzephyr4","binary_version":"3.1.2-1build3"},{"binary_name":"libzephyr4-krb5","binary_version":"3.1.2-1build3"},{"binary_name":"zephyr-clients","binary_version":"3.1.2-1build3"},{"binary_name":"zephyr-server","binary_version":"3.1.2-1build3"},{"binary_name":"zephyr-server-krb5","binary_version":"3.1.2-1build3"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-10658.json"}},{"package":{"name":"zephyr","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/zephyr?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.2-1build3"],"ecosystem_specific":{"binaries":[{"binary_name":"libzephyr4","binary_version":"3.1.2-1build3"},{"binary_name":"libzephyr4-krb5","binary_version":"3.1.2-1build3"},{"binary_version":"3.1.2-1build3","binary_name":"zephyr-clients"},{"binary_name":"zephyr-server","binary_version":"3.1.2-1build3"},{"binary_version":"3.1.2-1build3","binary_name":"zephyr-server-krb5"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-10658.json"}},{"package":{"name":"zephyr","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/zephyr?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.2-1.1","3.1.2-1.1build1"],"ecosystem_specific":{"binaries":[{"binary_name":"libzephyr4","binary_version":"3.1.2-1.1build1"},{"binary_version":"3.1.2-1.1build1","binary_name":"libzephyr4-krb5"},{"binary_name":"zephyr-clients","binary_version":"3.1.2-1.1build1"},{"binary_name":"zephyr-server","binary_version":"3.1.2-1.1build1"},{"binary_name":"zephyr-server-krb5","binary_version":"3.1.2-1.1build1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-10658.json"}},{"package":{"name":"zephyr","ecosystem":"Ubuntu:25.10","purl":"pkg:deb/ubuntu/zephyr?arch=source&distro=questing"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.2-1.1build1"],"ecosystem_specific":{"binaries":[{"binary_version":"3.1.2-1.1build1","binary_name":"libzephyr4"},{"binary_version":"3.1.2-1.1build1","binary_name":"libzephyr4-krb5"},{"binary_name":"zephyr-clients","binary_version":"3.1.2-1.1build1"},{"binary_name":"zephyr-server","binary_version":"3.1.2-1.1build1"},{"binary_name":"zephyr-server-krb5","binary_version":"3.1.2-1.1build1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-10658.json"}},{"package":{"name":"zephyr","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/zephyr?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.2-1.1build1","3.1.2-4"],"ecosystem_specific":{"binaries":[{"binary_name":"libzephyr4","binary_version":"3.1.2-4"},{"binary_name":"libzephyr4-krb5","binary_version":"3.1.2-4"},{"binary_version":"3.1.2-4","binary_name":"zephyr-clients"},{"binary_version":"3.1.2-4","binary_name":"zephyr-server"},{"binary_version":"3.1.2-4","binary_name":"zephyr-server-krb5"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-10658.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"},{"type":"Ubuntu","score":"medium"}]}