Executive brief
A vulnerability in the Linux kernel's Bluetooth component could allow a nearby attacker to crash the system. By sending a specifically malformed Bluetooth data packet, an attacker can trigger a system failure (kernel oops) without needing to be paired with the device. This primarily impacts the availability of the affected system and any services running on it.
Technical details
A NULL pointer dereference exists in net/bluetooth/iso.c within the iso_recv() function. The vulnerability is caused by a lack of validation for the packet-boundary flag sequence; specifically, the ISO_END branch does not check if a connection buffer (conn->rx_skb) has been initialized by a prior ISO_START frame. An attacker within Bluetooth range can send an ISO_END PDU as the first packet of a Broadcast Isochronous Stream (BIS) connection, triggering a NULL pointer dereference in skb_put(). This results in a kernel 'oops' and system crash. The issue has been patched by mirroring the validation logic used in the ISO_CONT branch to drop unexpected end frames.
Affected products
- Linux Linux 6.0 to 7.0.11
Timeline
- 2026-05-15: other: Vulnerability fix authored
- 2026-06-01: patched: Fix committed to stable kernel trees
- 2026-07-19: advisory: CVE-2026-64128 published
References
- https://git.kernel.org/stable/c/1c3d1e1696b72579b970e17999c503a14535205b
- https://git.kernel.org/stable/c/39f4a82e80c8f5ed2d6952d73fbafc895721a728
- https://git.kernel.org/stable/c/3af41ee7ebecb0d5c8a504861f6cfad31345310f
- https://git.kernel.org/stable/c/61f2410a96dee808029e2ae4d6ef2dd635f3477f
- https://git.kernel.org/stable/c/84c24fb151fc1179355296d7ff29129ac7c42129
- https://git.kernel.org/stable/c/e3a799881c12d27596232636a607e2e3fa448d63