A missing length validation in the Zephyr Bluetooth Host ISO receive pathway allows an attacker to send malformed HCI ISO data that passes the outer payload check but causes a kernel assertion or out‑of‑bounds read when the inner SDU header is extracted. The bug is triggered when bt_iso_recv() processes START/SINGLE fragments and pulls an 8‑byte or 4‑byte header without first confirming that the buffer contains at least that many bytes. The resulting assertion in assert‑enabled builds or buffer under‑read in other builds deterministically crashes the kernel, providing a clear‑cut denial‑of‑service vector with no direct code execution.

The vulnerability impacts any system running the Zephyr RTOS Bluetooth Host stack with CONFIG_BT_ISO_RX enabled, including all zephyrproject‑rtos:Zephyr products that accept incoming ISO HCI traffic. No specific patch level is listed, so any build containing the unpatched host code remains vulnerable.

The CVSS base score of 7.1 indicates a high severity DoS. The EPSS score is not available, and the issue is not catalogued in the CISA KEV list. The likely attack vector is a malicious or compromised Bluetooth controller or an attacker who can inject crafted ISO packets within range of the target device. Because the flaw only manifests when the controller sends data, proximity to the targeted device is required. There is no privilege escalation or information disclosure associated with the exploitation path, but the severity of the crash and the ease of triggering it by sending a single malformed packet makes it a serious operational risk.