CVE-2026-64128

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the Bluetooth ISO implementation where the system fails to properly handle ISO END frames received without a preceding ISO START frame. In the iso recv() function, the ISO END branch does not verify if a packet has already started by checking conn->rx len before accessing conn->rx skb. If a peer sends an ISO END as the first packet on a new ISO connection, the system attempts to call skb put() on a NULL conn->rx skb pointer, leading to a null pointer dereference and a system crash. In Broadcast Iso Streams (BIS), where receivers synchronize to a broadcaster without pairing, any broadcaster can trigger this condition.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.