Riskcovery

CVE-2026-64128

Bluetooth: ISO: drop ISO_END frames received without prior ISO_START

State
Published
Severity
Not scored
Published
Jul 19, 2026
Updated
Jul 19, 2026
Reserved
Jul 19, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: drop ISO_END frames received without prior ISO_START

ISO data PDUs carry a packet-boundary flag indicating START, CONT, END or SINGLE. The ISO_CONT branch of iso_recv() guards against a missing ISO_START by checking conn->rx_len before touching conn->rx_skb, but ISO_END does not.

If a peer sends an ISO_END as the first packet on a fresh ISO connection, conn->rx_skb is still NULL and conn->rx_len is zero, so skb_put(conn->rx_skb, ...) dereferences NULL and oopses. For BIS, where receivers sync to a broadcaster without pairing, any broadcaster on the air can trigger this.

Mirror the ISO_CONT check at the top of ISO_END so a stray end fragment is logged and dropped instead of crashing the host.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • ccf74f2390d60a2f9a75ef496d2564abb478f46a to before 1c3d1e1696b72579b970e17999c503a14535205bAffected
  • ccf74f2390d60a2f9a75ef496d2564abb478f46a to before 3af41ee7ebecb0d5c8a504861f6cfad31345310fAffected
  • ccf74f2390d60a2f9a75ef496d2564abb478f46a to before 39f4a82e80c8f5ed2d6952d73fbafc895721a728Affected
  • ccf74f2390d60a2f9a75ef496d2564abb478f46a to before 61f2410a96dee808029e2ae4d6ef2dd635f3477fAffected
  • ccf74f2390d60a2f9a75ef496d2564abb478f46a to before e3a799881c12d27596232636a607e2e3fa448d63Affected
  • ccf74f2390d60a2f9a75ef496d2564abb478f46a to before 84c24fb151fc1179355296d7ff29129ac7c42129Affected
LinuxLinux
  • 6.0Affected
  • before 6.0Not affected
  • 6.1.175 through 6.1.*Not affected
  • 6.6.142 through 6.6.*Not affected
  • 6.12.92 through 6.12.*Not affected
  • 6.18.34 through 6.18.*Not affected
  • 7.0.11 through 7.0.*Not affected
  • 7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.