CVE-2026-64128 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: ISO: drop ISO_END frames received without prior ISO_START
ISO data PDUs carry a packet-boundary flag indicating START, CONT, END or SINGLE. The ISO_CONT branch of iso_recv() guards against a missing ISO_START by checking conn->rx_len before touching conn->rx_skb, but ISO_END does not.
If a peer sends an ISO_END as the first packet on a fresh ISO connection, conn->rx_skb is still NULL and conn->rx_len is zero, so skb_put(conn->rx_skb, ...) dereferences NULL and oopses. For BIS, where receivers sync to a broadcaster without pairing, any broadcaster on the air can trigger this.
Mirror the ISO_CONT check at the top of ISO_END so a stray end fragment is logged and dropped instead of crashing the host.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/19/2026
This vulnerability exists in the Linux kernel's Bluetooth implementation within the ISO (Individual Sound Object) communication protocol handling code. The issue stems from an asymmetric validation approach in the iso_recv() function where different packet boundary flags are processed with varying levels of input validation. Specifically, the ISO_CONT branch includes proper null pointer checks to prevent dereferencing uninitialized memory structures, but the ISO_END branch lacks this critical safeguard.
The technical flaw manifests when a Bluetooth peer device sends an ISO_END packet as the initial communication on a fresh ISO connection. In this scenario, the connection's receive buffer structure conn->rx_skb remains NULL while conn->rx_len equals zero, creating a dangerous condition where skb_put() attempts to operate on a null pointer reference. This fundamental memory access violation results in a kernel oops and system crash, effectively causing a denial of service condition that impacts the entire Bluetooth subsystem.
The operational impact of this vulnerability is particularly severe given the widespread use of Bluetooth ISO connections in audio streaming applications such as wireless headphones, speakers, and automotive audio systems. The vulnerability affects BIS (Broadcast Isochronous Streams) implementations where devices synchronize to broadcast sources without requiring prior pairing or authentication. This means any malicious or errant Bluetooth broadcaster within range can exploit this flaw to crash the host system, potentially affecting mobile devices, laptops, servers, or embedded systems running Linux kernels with Bluetooth support.
The vulnerability aligns with CWE-476 which identifies NULL pointer dereference as a critical weakness in software security. From an adversarial perspective, this issue maps directly to ATT&CK technique T1547.001 related to process injection and system compromise through kernel-level exploits. The attack vector requires minimal privileges since it targets the Bluetooth protocol stack rather than requiring user-level access or elevated permissions. The fix implements a mirror of the existing ISO_CONT validation logic at the beginning of the ISO_END processing branch, ensuring that stray end fragments are properly logged and dropped instead of causing system crashes.
Mitigation strategies should include immediate kernel updates from distribution vendors to address this specific vulnerability in Bluetooth ISO handling code. System administrators should prioritize patching affected Linux kernels across all devices running Bluetooth services, particularly those in critical infrastructure or mobile environments where continuous operation is essential. Additional monitoring should be implemented to detect anomalous Bluetooth traffic patterns that might indicate exploitation attempts, while network segmentation can help limit the potential impact of such attacks within larger systems. The fix demonstrates proper defensive programming practices by ensuring consistent validation across all code paths handling similar data structures and reduces the attack surface for kernel-level exploits targeting Bluetooth protocol implementations.