CVE-2026-64128: Linux Kernel Bluetooth ISO DoS Flaw

CVE-2026-64128 Overview

CVE-2026-64128 is a NULL pointer dereference vulnerability in the Linux kernel's Bluetooth Isochronous (ISO) data path. The flaw resides in the iso_recv() function, which processes ISO data Protocol Data Units (PDUs) carrying a packet-boundary flag of START, CONT, END, or SINGLE. The ISO_END branch does not validate that a prior ISO_START fragment was received before dereferencing conn->rx_skb. A remote attacker can send a stray ISO_END fragment as the first packet on a fresh ISO connection to trigger a kernel oops. For Broadcast Isochronous Streams (BIS), receivers synchronize to a broadcaster without pairing, so any nearby broadcaster on the air can trigger the crash.

Critical Impact
Any Bluetooth broadcaster within radio range can crash a vulnerable Linux host by transmitting a single malformed ISO_END fragment, causing a denial of service without authentication or pairing.

Affected Products

Linux kernel Bluetooth subsystem (ISO/BIS receive path in iso_recv())
Linux distributions shipping affected upstream kernel versions prior to the six stable backports
Hosts with Bluetooth LE Audio or Broadcast Isochronous Stream support enabled

Discovery Timeline

2026-07-19 - CVE-2026-64128 published to the National Vulnerability Database (NVD)
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-64128

Vulnerability Analysis

ISO data PDUs in Bluetooth carry a two-bit packet-boundary flag indicating whether a fragment is ISO_START, ISO_CONT, ISO_END, or ISO_SINGLE. The kernel reassembles multi-fragment PDUs by allocating a socket buffer (conn->rx_skb) on ISO_START and appending subsequent ISO_CONT and ISO_END payloads with skb_put(). The ISO_CONT branch of iso_recv() correctly guards against a missing start by checking conn->rx_len before touching conn->rx_skb. The ISO_END branch omits the same check.

When a peer transmits an ISO_END fragment as the first packet on a new ISO connection, conn->rx_skb remains NULL and conn->rx_len is zero. The call to skb_put(conn->rx_skb, ...) dereferences the NULL pointer and oopses the kernel. Because BIS receivers synchronize to broadcasters without any authentication or pairing, exploitation requires only radio proximity.

Root Cause

The root cause is missing input validation on the ISO packet-boundary state machine. The ISO_END code path assumes a reassembly buffer already exists, but the protocol permits any peer to send arbitrary fragment types in any order over the air. The kernel patch mirrors the existing ISO_CONT guard at the top of the ISO_END branch so that a stray end fragment is logged and dropped rather than dereferenced.

Attack Vector

Exploitation is performed over the air using standard Bluetooth Low Energy radio. An attacker within Bluetooth range crafts an ISO PDU with the packet-boundary flag set to ISO_END and transmits it as the first packet on a broadcast or unicast ISO channel. For BIS, no pairing, bonding, or user interaction is required. The vulnerability results in a kernel NULL pointer dereference and system crash, producing a wireless denial-of-service condition against any Linux host with Bluetooth ISO support enabled.

No verified public proof-of-concept code is available. The upstream fix is documented across six stable-tree commits including 1c3d1e16, 39f4a82e, and 3af41ee7.

Detection Methods for CVE-2026-64128

Indicators of Compromise

Kernel oops or panic messages referencing iso_recv, skb_put, or the Bluetooth hci subsystem in dmesg or /var/log/kern.log
Repeated Bluetooth controller resets or hci0 interface disconnects following ISO or BIS traffic
Unexpected system reboots on hosts with Bluetooth LE Audio or BIS receivers enabled in physical proximity to unknown broadcasters

Detection Strategies

Monitor kernel ring buffer output for NULL pointer dereference stack traces originating in net/bluetooth/iso.c
Correlate Bluetooth adapter state transitions with system crash events using endpoint telemetry
Audit installed kernel package versions across the fleet against the fixed stable-tree commits

Monitoring Recommendations

Alert on kernel crash artifacts such as kdump files, pstore entries, or systemd-coredump events on Linux endpoints
Track host availability metrics on Linux systems that participate in Bluetooth LE Audio or BIS use cases
Ingest dmesg and journalctl -k output into a centralized logging platform for retrospective analysis of Bluetooth-related faults

How to Mitigate CVE-2026-64128

Immediate Actions Required

Apply the latest kernel updates from your Linux distribution vendor that include the upstream stable-tree fixes
If patching is not immediately feasible, disable Bluetooth on affected hosts using rfkill block bluetooth or unload the bluetooth kernel module
Restrict physical or radio access to affected devices until patched, particularly for systems configured as BIS receivers

Patch Information

The fix adds a conn->rx_len guard at the top of the ISO_END branch of iso_recv(), mirroring the existing ISO_CONT check. Stray end fragments are now logged and dropped instead of dereferencing a NULL rx_skb. The change is available in the following stable-tree commits: 1c3d1e16, 39f4a82e, 3af41ee7, 61f2410a, 84c24fb1, and e3a79988.

Workarounds

Disable the Bluetooth stack on servers and workstations that do not require it by masking the bluetooth.service unit in systemd
Blacklist the bluetooth and related ISO kernel modules on hosts that never participate in LE Audio or BIS
Disable ISO or LE Audio features in the controller configuration where the platform exposes such toggles

bash

# Configuration example: disable Bluetooth to mitigate exposure
sudo systemctl stop bluetooth.service
sudo systemctl mask bluetooth.service
sudo rfkill block bluetooth

# Prevent the module from loading at boot
echo 'blacklist bluetooth' | sudo tee /etc/modprobe.d/disable-bluetooth.conf
echo 'blacklist btusb'     | sudo tee -a /etc/modprobe.d/disable-bluetooth.conf
sudo update-initramfs -u