CVE-2026-72334

HighCVSS 8.8

Published: 15/08/2026(UTC)Updated: 17/08/2026(UTC)Translated: 15/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.34%

27th percentile - higher than 27% of all known CVEs

Summary

In the Linux kernel's Bluetooth ISO subsystem, there is a vulnerability related to improper handling of ISO_END/CONT packets. Incorrect handling can lead to memory leak of conn->rx_skb, kernel panic on skb_put, or acceptance of too short ISO_END packets.

Risk Assessment

The vulnerability can lead to kernel memory leaks, system crashes (panics), or improper Bluetooth stack behavior. However, it requires control over the Bluetooth controller, limiting risk.

Recommendation

Apply the kernel patch that marks unfinished ISO_START via conn->rx_skb != NULL, checks skb length before skb_put, and combines ISO_CONT/END code paths. Also update the kernel to a patched version.

Original NVD description (English source)

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix malformed ISO_END/CONT handling Core specification (Part C vol 4 sec 5.4.5) does not exclude empty ISO_CONT, ISO_END packets. We currently reject them if they are last. If controller sends malformed sequence ISO_START -> rx_len = 4, ISO_CONT skb->len 4, ISO_START that ends payload in ISO_CONT, we leak conn->rx_skb. If controller sends too long ISO_END, we panic on skb_put. If controller sends too short ISO_END we accept it. Fix by marking unfinished ISO_START via conn->rx_skb != NULL. Check skb->len properly before skb_put. Combine the ISO_CONT/END code paths as they require the same initial checks. Reject too short ISO_END packets.