CVE-2026-64128

Analyzed Analyzed - Analysis Complete

Bluetooth ISO End Frame Handling Flaw in Linux Kernel

Publication date: 2026-07-19

Last updated on: 2026-08-13

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: drop ISO_END frames received without prior ISO_START ISO data PDUs carry a packet-boundary flag indicating START, CONT, END or SINGLE. The ISO_CONT branch of iso_recv() guards against a missing ISO_START by checking conn->rx_len before touching conn->rx_skb, but ISO_END does not. If a peer sends an ISO_END as the first packet on a fresh ISO connection, conn->rx_skb is still NULL and conn->rx_len is zero, so skb_put(conn->rx_skb, ...) dereferences NULL and oopses. For BIS, where receivers sync to a broadcaster without pairing, any broadcaster on the air can trigger this. Mirror the ISO_CONT check at the top of ISO_END so a stray end fragment is logged and dropped instead of crashing the host.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-19

Last Modified

2026-08-13

Generated

2026-08-29

AI Q&A

2026-07-19

EPSS Evaluated

2026-08-28

NVD

CVE-2026-64128

EUVD

EUVD-2026-45813

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 6.7 (inc) to 6.12.92 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.34 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.11 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.142 (exc)
linux	linux_kernel	From 6.0 (inc) to 6.1.175 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves Bluetooth ISO (isochronous) data handling. A flaw exists where ISO_END frames can be received without a prior ISO_START frame. The code fails to check if the receive buffer is initialized before processing such frames, leading to a NULL pointer dereference and system crash.

Detection Guidance

This vulnerability involves Bluetooth ISO data PDUs and can cause a kernel crash if exploited. Detection requires monitoring for unexpected Bluetooth ISO_END frames. Check kernel logs for NULL pointer dereference errors related to Bluetooth ISO handling. Use commands like 'dmesg | grep -i bluetooth' or 'journalctl -k | grep -i bluetooth' to inspect logs for crashes or errors.

Impact Analysis

An attacker within Bluetooth range could exploit this to crash a vulnerable Linux system by sending a malformed ISO_END frame. This could cause denial-of-service conditions, requiring a reboot to restore functionality.

Compliance Impact

This vulnerability causes a kernel crash (oops) when processing malformed Bluetooth ISO_END frames, which could lead to denial-of-service conditions. Such instability may impact system availability and integrity, potentially violating compliance requirements for reliability and data protection in standards like GDPR (availability) and HIPAA (system integrity).

Mitigation Strategies

Apply the Linux kernel patch that resolves this issue. Update your system to the latest stable kernel version where this vulnerability is fixed. If patching is not immediately possible, disable Bluetooth ISO functionality temporarily or restrict Bluetooth access to trusted devices until the patch is applied.

Hi! I’m here to help you understand CVE-2026-64128. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70