A missing length validation in the Zephyr Bluetooth Host ISO receive routine allows a controller or adjacent BLE peer to send an ISO packet whose first fragment or single PDU is shorter than the expected header, even when the timestamp flag is set, triggering an 8‑byte timestamped header. The routine pulls the SDU header without checking the length buffer; this underflow moves the data pointer past the end of the packet and causes out‑of‑bounds reads of header fields. In multi‑fragment streams the corrupted buffer is retained and a later fragment triggers a tailroom guard underflow, permitting an out‑of‑bounds write when the fragment data is copied into the receive pool. These memory corruptions repeatedly crash the kernel, delivering a clear denial‑of‑service vector through bus or memory corruption, but they do not provide code execution.

The vulnerability impacts any system running the zephyrproject:zephyr Bluetooth Host stack with CONFIG_BT_ISO_RX enabled, including all zephyrproject:zephyr products that accept incoming ISO HCI traffic. No specific patch level is listed, so any build containing the unpatched host code remains vulnerable.

The CVSS base score of 7.1 indicates a high severity DoS. The EPSS score is < 1% and the issue is not catalogued in the CISA KEV list. The likely attack vector is a malicious or compromised Bluetooth controller or an attacker who can inject crafted ISO packets within range of the target device. Because the flaw only manifests when the controller sends data, proximity to the targeted device is required. There is no privilege escalation or information disclosure associated with the exploitation path, but the severity of the crash and the ease of triggering it by sending a single malformed packet make it a serious operational risk.