CVE-2026-64128
Received Received - Intake

Bluetooth ISO End Frame Handling Flaw in Linux Kernel

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: drop ISO_END frames received without prior ISO_START ISO data PDUs carry a packet-boundary flag indicating START, CONT, END or SINGLE. The ISO_CONT branch of iso_recv() guards against a missing ISO_START by checking conn->rx_len before touching conn->rx_skb, but ISO_END does not. If a peer sends an ISO_END as the first packet on a fresh ISO connection, conn->rx_skb is still NULL and conn->rx_len is zero, so skb_put(conn->rx_skb, ...) dereferences NULL and oopses. For BIS, where receivers sync to a broadcaster without pairing, any broadcaster on the air can trigger this. Mirror the ISO_CONT check at the top of ISO_END so a stray end fragment is logged and dropped instead of crashing the host.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64128
EUVD
EUVD-2026-45813

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves Bluetooth ISO (isochronous) data handling. A flaw exists where ISO_END frames can be received without a prior ISO_START frame. The code fails to check if the receive buffer is initialized before processing such frames, leading to a NULL pointer dereference and system crash.

Detection Guidance

This vulnerability involves Bluetooth ISO data PDUs and can cause a kernel crash if exploited. Detection requires monitoring for unexpected Bluetooth ISO_END frames. Check kernel logs for NULL pointer dereference errors related to Bluetooth ISO handling. Use commands like 'dmesg | grep -i bluetooth' or 'journalctl -k | grep -i bluetooth' to inspect logs for crashes or errors.

Impact Analysis

An attacker within Bluetooth range could exploit this to crash a vulnerable Linux system by sending a malformed ISO_END frame. This could cause denial-of-service conditions, requiring a reboot to restore functionality.

Compliance Impact

This vulnerability causes a kernel crash (oops) when processing malformed Bluetooth ISO_END frames, which could lead to denial-of-service conditions. Such instability may impact system availability and integrity, potentially violating compliance requirements for reliability and data protection in standards like GDPR (availability) and HIPAA (system integrity).

Mitigation Strategies

Apply the Linux kernel patch that resolves this issue. Update your system to the latest stable kernel version where this vulnerability is fixed. If patching is not immediately possible, disable Bluetooth ISO functionality temporarily or restrict Bluetooth access to trusted devices until the patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64128. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart