CVE-2026-64128 Bluetooth: ISO: drop ISO_END frames received without prior ISO_START
A remote attacker can crash the Linux kernel by sending a malformed Bluetooth ISO_END frame without a prior start, causing a null pointer dereference.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-64128?
CVE-2026-64128 is a medium-severity vulnerability in Linux kernel, published on 19 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: ISO: drop ISO_END frames received without prior ISO_START
ISO data PDUs carry a packet-boundary flag indicating START, CONT, END or SINGLE. The ISO_CONT branch of iso_recv() guards against a missing ISO_START by checking conn->rx_len before touching conn->rx_skb, but ISO_END does not.
If a peer sends an ISO_END as the first packet on a fresh ISO connection, conn->rx_skb is still NULL and conn->rx_len is zero, so skb_put(conn->rx_skb, ...) dereferences NULL and oopses. For BIS, where receivers sync to a broadcaster without pairing, any broadcaster on the air can trigger this.
Mirror the ISO_CONT check at the top of ISO_END so a stray end fragment is logged and dropped instead of crashing the host.
Weakness: CWE-476
Which versions are affected by CVE-2026-64128?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-64128?
Apply the vendor's patch.
Is CVE-2026-64128 being exploited?
There is no known exploitation of CVE-2026-64128 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-64128, DEBIAN-CVE-2026-64128, GHSA-qwwx-92m3-hf86, UBUNTU-CVE-2026-64128.