CVE-2026-64128 - Vulnerability Details

- Bluetooth: ISO: drop ISO_END frames received without prior ISO_START

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: drop ISO_END frames received without prior ISO_START

ISO data PDUs carry a packet-boundary flag indicating START, CONT, END
or SINGLE. The ISO_CONT branch of iso_recv() guards against a missing
ISO_START by checking conn->rx_len before touching conn->rx_skb, but
ISO_END does not.

If a peer sends an ISO_END as the first packet on a fresh ISO
connection, conn->rx_skb is still NULL and conn->rx_len is zero, so
skb_put(conn->rx_skb, ...) dereferences NULL and oopses. For BIS,
where receivers sync to a broadcaster without pairing, any broadcaster
on the air can trigger this.

Mirror the ISO_CONT check at the top of ISO_END so a stray end fragment
is logged and dropped instead of crashing the host.

Published: 2026-07-19

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The kernel’s Bluetooth ISO subsystem has a NULL pointer dereference that occurs when an ISO_END packet is received as the first fragment of a new ISO connection. The code does not guard against a missing ISO_START for ISO_END, causing a direct dereference of a NULL skb pointer and resulting in an oops that crashes the host. This flaw is a classic NULL pointer dereference defect (CWE‑476) and leads to a denial‑of‑service condition at the system level.

Affected Systems

All Linux kernel releases that ship with the unpatched Bluetooth ISO code are affected. The vulnerability is tied to generic Linux kernels; any distribution that uses the default kernel without the fix is potentially vulnerable. The kernel patch is referenced via several commit IDs on kernel.org, but no specific minor kernel version is provided in the advisory.

Risk and Exploitability

The CVSS score is 5.5, indicating a moderate severity vulnerability. The EPSS score is less than 1%, implying a very low exploitation probability at the time of analysis. The flaw is not listed in CISA’s KEV catalog. Attackers need to establish a Bluetooth ISO connection; they may launch the attack by sending an ISO_END packet as the first fragment on a fresh connection. Because ISO partners can sync to a broadcaster without pairing, any nearby broadcaster on the air can trigger the crash, making the vulnerability discoverable remotely via Bluetooth.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`ccf74f2390d60a2f9a75ef496d2564abb478f46a`	affected	< 1c3d1e1696b72579b970e17999c503a14535205b
`ccf74f2390d60a2f9a75ef496d2564abb478f46a`	affected	< 3af41ee7ebecb0d5c8a504861f6cfad31345310f
`ccf74f2390d60a2f9a75ef496d2564abb478f46a`	affected	< 39f4a82e80c8f5ed2d6952d73fbafc895721a728
`ccf74f2390d60a2f9a75ef496d2564abb478f46a`	affected	< 61f2410a96dee808029e2ae4d6ef2dd635f3477f
`ccf74f2390d60a2f9a75ef496d2564abb478f46a`	affected	< e3a799881c12d27596232636a607e2e3fa448d63
`ccf74f2390d60a2f9a75ef496d2564abb478f46a`	affected	< 84c24fb151fc1179355296d7ff29129ac7c42129

Linux

affected

Version	Status	Constraints
`6.0`	affected	—
`0`	unaffected	< 6.0
`6.1.175`	unaffected	≤ 6.1.*
`6.6.142`	unaffected	≤ 6.6.*
`6.12.92`	unaffected	≤ 6.12.*
`6.18.34`	unaffected	≤ 6.18.*
`7.0.11`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[ccf74f2390d60a2f9a75ef496d2564abb478f46a,1c3d1e1696b72579b970e17999c503a14535205b)`	affected	code_commit	—
`[ccf74f2390d60a2f9a75ef496d2564abb478f46a,3af41ee7ebecb0d5c8a504861f6cfad31345310f)`	affected	code_commit	—
`[ccf74f2390d60a2f9a75ef496d2564abb478f46a,39f4a82e80c8f5ed2d6952d73fbafc895721a728)`	affected	code_commit	—
`[ccf74f2390d60a2f9a75ef496d2564abb478f46a,61f2410a96dee808029e2ae4d6ef2dd635f3477f)`	affected	code_commit	—
`[ccf74f2390d60a2f9a75ef496d2564abb478f46a,e3a799881c12d27596232636a607e2e3fa448d63)`	affected	code_commit	—
`[ccf74f2390d60a2f9a75ef496d2564abb478f46a,84c24fb151fc1179355296d7ff29129ac7c42129)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.0`	affected	semver	—
`[0,6.0)`	unaffected	semver	—
`[6.1.175,6.2.0)`	unaffected	semver	—
`[6.6.142,6.7.0)`	unaffected	semver	—
`[6.12.92,6.13.0)`	unaffected	semver	—
`[6.18.34,6.19.0)`	unaffected	semver	—
`[7.0.11,7.1.0)`	unaffected	semver	—
`[7.1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes the commit sequence referenced in the advisory (e.g., merge the changes from commit 1c3d1e1696b7 or any later commit that fixes the ISO_END NULL dereference).
If an official kernel upgrade is not immediately available, apply the patch manually by cherry‑picking the relevant commits from the Linux kernel repository into your current kernel source and re‑building the kernel.
Temporarily disable the Bluetooth ISO data transfer subsystem or the entire Bluetooth stack on systems that do not require Bluetooth ISO functionality until a patched kernel is deployed.

Generated by OpenCVE AI on July 30, 2026 at 20:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-8593-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8603-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8618-1	Linux kernel vulnerabilities

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0018.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/1c3d1e1696b72579b970e17999c503a14535205b
https://git.kernel.org/stable/c/39f4a82e80c8f5ed2d6952d73fbafc895721a728
https://git.kernel.org/stable/c/3af41ee7ebecb0d5c8a504861f6cfad31345310f
https://git.kernel.org/stable/c/61f2410a96dee808029e2ae4d6ef2dd635f3477f
https://git.kernel.org/stable/c/84c24fb151fc1179355296d7ff29129ac7c42129
https://git.kernel.org/stable/c/e3a799881c12d27596232636a607e2e3fa448d63
https://lore.kernel.org/linux-cve-announce/2026071926-CVE-2026-64128-f336@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64128
https://www.cve.org/CVERecord?id=CVE-2026-64128

History

Mon, 20 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476
References		https://lore.kernel.org/linux-cve-announce/2026071926-CVE-2026-64128-f336@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64128 https://www.cve.org/CVERecord?id=CVE-2026-64128
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sun, 19 Jul 2026 16:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: drop ISO_END frames received without prior ISO_START ISO data PDUs carry a packet-boundary flag indicating START, CONT, END or SINGLE. The ISO_CONT branch of iso_recv() guards against a missing ISO_START by checking conn->rx_len before touching conn->rx_skb, but ISO_END does not. If a peer sends an ISO_END as the first packet on a fresh ISO connection, conn->rx_skb is still NULL and conn->rx_len is zero, so skb_put(conn->rx_skb, ...) dereferences NULL and oopses. For BIS, where receivers sync to a broadcaster without pairing, any broadcaster on the air can trigger this. Mirror the ISO_CONT check at the top of ISO_END so a stray end fragment is logged and dropped instead of crashing the host.
Title		Bluetooth: ISO: drop ISO_END frames received without prior ISO_START
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1c3d1e1696b72579b970e17999c503a14535205b https://git.kernel.org/stable/c/39f4a82e80c8f5ed2d6952d73fbafc895721a728 https://git.kernel.org/stable/c/3af41ee7ebecb0d5c8a504861f6cfad31345310f https://git.kernel.org/stable/c/61f2410a96dee808029e2ae4d6ef2dd635f3477f https://git.kernel.org/stable/c/84c24fb151fc1179355296d7ff29129ac7c42129 https://git.kernel.org/stable/c/e3a799881c12d27596232636a607e2e3fa448d63

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-19T15:40:24.678Z

Updated: 2026-07-19T15:40:24.678Z

Reserved: 2026-07-19T07:54:57.036Z

Link: CVE-2026-64128

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Moderate

Publid Date: 2026-07-19T00:00:00Z

Links: CVE-2026-64128 - Bugzilla

OpenCVE Enrichment

Updated: 2026-07-30T20:30:04Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object