PT-2026-61445 · Linux · Linux

CVE-2026-64128 · Published 2026-07-19 · Updated 2026-07-19

NVD

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: drop ISO END frames received without prior ISO START

ISO data PDUs carry a packet-boundary flag indicating START, CONT, END or SINGLE. The ISO CONT branch of iso recv() guards against a missing ISO START by checking conn->rx len before touching conn->rx skb, but ISO END does not.

If a peer sends an ISO END as the first packet on a fresh ISO connection, conn->rx skb is still NULL and conn->rx len is zero, so skb put(conn->rx skb, ...) dereferences NULL and oopses. For BIS, where receivers sync to a broadcaster without pairing, any broadcaster on the air can trigger this.

Mirror the ISO CONT check at the top of ISO END so a stray end fragment is logged and dropped instead of crashing the host.

Related Identifiers

CVE-2026-64128

Affected Products

Linux

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-64128 · Security Note
• https://git.kernel.org/stable/c/3af41ee7ebecb0d5c8a504861f6cfad31345310f · Note
• https://git.kernel.org/stable/c/61f2410a96dee808029e2ae4d6ef2dd635f3477f · Note
• https://git.kernel.org/stable/c/1c3d1e1696b72579b970e17999c503a14535205b · Note
• https://git.kernel.org/stable/c/e3a799881c12d27596232636a607e2e3fa448d63 · Note
• https://git.kernel.org/stable/c/39f4a82e80c8f5ed2d6952d73fbafc895721a728 · Note
• https://git.kernel.org/stable/c/84c24fb151fc1179355296d7ff29129ac7c42129 · Note