Bluetooth Vulnerability in Zephyr RTOS Affecting Data Length Validation

CVE-2026-90832

What is CVE-2026-90832?

A flaw in the Bluetooth implementation of Zephyr RTOS allows a malicious controller to send improperly declared data lengths during periodic advertising reports. The issue occurs in the handling of HCI_LE_Periodic_Advertising_Report events where the data length is verified against the buffer's available space, but the actual payload length is not validated. Attackers could exploit this to induce out-of-bounds reads, revealing sensitive memory contents to application listeners without causing memory corruption. The existing checks do not appropriately safeguard against reported lengths exceeding actual payload sizes, potentially leading to information disclosure.

References