CVE-2026-72334
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Bluetooth: ISO: fix malformed ISO_END/CONT handling
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix malformed ISO_END/CONT handling Core specification (Part C vol 4 sec 5.4.5) does not exclude empty ISO_CONT, ISO_END packets. We currently reject them if they are last. If controller sends malformed sequence ISO_START -> rx_len = 4, ISO_CONT skb->len 4, ISO_START that ends payload in ISO_CONT, we leak conn->rx_skb. If controller sends too long ISO_END, we panic on skb_put. If controller sends too short ISO_END we accept it. Fix by marking unfinished ISO_START via conn->rx_skb != NULL. Check skb->len properly before skb_put. Combine the ISO_CONT/END code paths as they require the same initial checks. Reject too short ISO_END packets.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| ccf74f2390d60a2f9a75ef496d2564abb478f46a | affected | git | d2df29dc9abda2fc10ff522eac0969f5b77b3637 | Unavailable | None listed |
| ccf74f2390d60a2f9a75ef496d2564abb478f46a | affected | git | 7250b6b5ba9b737cff2c2c1d0760360c7b6bca00 | Unavailable | None listed |
| ccf74f2390d60a2f9a75ef496d2564abb478f46a | affected | git | 49aeb54e3c912ef785311264a51ab9f3698e421b | Unavailable | None listed |
| ccf74f2390d60a2f9a75ef496d2564abb478f46a | affected | git | 5e53e285f8c989662e34d4938c728a94226bff34 | Unavailable | None listed |
| ccf74f2390d60a2f9a75ef496d2564abb478f46a | affected | git | 990e65eb9387c4ddfa7f68782b6644c2c35d489f | Unavailable | None listed |
| ccf74f2390d60a2f9a75ef496d2564abb478f46a | affected | git | e054c1a6ae7310d2815778fddb87da616e11c255 | Unavailable | None listed |
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
affected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 6.0 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 0 | unaffected | semver | 6.0 | Unavailable | None listed |
| 6.1.189 | unaffected | semver | Unavailable | 6.1.* | None listed |
| 6.6.158 | unaffected | semver | Unavailable | 6.6.* | None listed |
| 6.12.111 | unaffected | semver | Unavailable | 6.12.* | None listed |
| 6.18.53 | unaffected | semver | Unavailable | 6.18.* | None listed |
| 7.1.5 | unaffected | semver | Unavailable | 7.1.* | None listed |
| 7.2 | unaffected | original_commit_for_fix | Unavailable | * | None listed |