CVE-2026-64128: Bluetooth: ISO: drop ISO_END frames received without prior ISO_START
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: ISO: drop ISOEND frames received without prior ISOSTART
ISO data PDUs carry a packet-boundary flag indicating START, CONT, END or SINGLE. The ISOCONT branch of isorecv() guards against a missing ISOSTART by checking conn->rxlen before touching conn->rxskb, but ISOEND does not.
If a peer sends an ISOEND as the first packet on a fresh ISO connection, conn->rxskb is still NULL and conn->rxlen is zero, so skbput(conn->rxskb, ...) dereferences NULL and oopses. For BIS, where receivers sync to a broadcaster without pairing, any broadcaster on the air can trigger this.
Mirror the ISOCONT check at the top of ISOEND so a stray end fragment is logged and dropped instead of crashing the host.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64128?
CVE-2026-64128 has a risk score of 62, indicating a medium severity vulnerability.
How do I fix CVE-2026-64128?
To fix CVE-2026-64128, users should update their Linux kernel to the latest version where this vulnerability has been resolved.
What systems are affected by CVE-2026-64128?
CVE-2026-64128 affects the Linux kernel, specifically systems utilizing Bluetooth ISO data PDUs.
What type of vulnerability is CVE-2026-64128?
CVE-2026-64128 is a vulnerability related to improper handling of Bluetooth ISO frames in the Linux kernel.
Can CVE-2026-64128 lead to a security breach?
While CVE-2026-64128 poses a medium risk, it could potentially lead to issues if exploited, affecting Bluetooth communication integrity.