CVE-2026-72334: Bluetooth: ISO: fix malformed ISO_END/CONT handling
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: ISO: fix malformed ISOEND/CONT handling
Core specification (Part C vol 4 sec 5.4.5) does not exclude empty ISOCONT, ISOEND packets. We currently reject them if they are last.
If controller sends malformed sequence
ISOSTART -> rxlen = 4, ISOCONT skb->len 4, ISOSTART
that ends payload in ISOCONT, we leak conn->rxskb. If controller sends too long ISOEND, we panic on skbput. If controller sends too short ISOEND we accept it.
Fix by marking unfinished ISOSTART via conn->rxskb != NULL. Check skb->len properly before skbput. Combine the ISOCONT/END code paths as they require the same initial checks. Reject too short ISOEND packets.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel Bluetooth ISO handlingto a version that resolves this vulnerability.Patch Reject too short ISO_END - Configuration
Combine the ISO_CONT/END code paths and fix malformed ISO_END/CONT handling by marking unfinished ISO_START via conn->rx_skb != NULL.
Linux kernel Bluetooth ISO_CONT/ISO_END handling = combined ISO_CONT/END code paths - Configuration
Reject too short ISO_END packets (we currently reject them only if they are last, but they should be rejected as they require the same initial checks).
Linux kernel Bluetooth ISO_END validation = reject too short ISO_END - Configuration
Ensure skb->len is properly set before skb_put to prevent payload-ending ISO_CONT leaks (conn->rx_skb) and to avoid panic when ISO_END is too long.
Linux kernel Bluetooth skb->len / skb_put usage = ensure skb->len checked before skb_put