{"id":"CVE-2026-72334","revision":"87e8a22ab2d64556a090daf10981cf33","records":[{"revision":"87e8a22ab2d64556a090daf10981cf33","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-72334","aliases":[],"title":"Bluetooth: ISO: fix malformed ISO_END/CONT handling","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: fix malformed ISO_END/CONT handling\n\nCore specification (Part C vol 4 sec 5.4.5) does not exclude empty\nISO_CONT, ISO_END packets.  We currently reject them if they are last.\n\nIf controller sends malformed sequence\n\n    ISO_START -> rx_len = 4, ISO_CONT skb->len 4, ISO_START\n\nthat ends payload in ISO_CONT, we leak conn->rx_skb. If controller sends\ntoo long ISO_END, we panic on skb_put. If controller sends too short\nISO_END we accept it.\n\nFix by marking unfinished ISO_START via conn->rx_skb != NULL.  Check\nskb->len properly before skb_put.  Combine the ISO_CONT/END code paths\nas they require the same initial checks. Reject too short ISO_END\npackets.","state":0,"publishedAt":"2026-08-15T05:55:43.16+00:00","modifiedAt":"2026-10-16T18:55:18.395+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/bluetooth/iso.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"ccf74f2390d60a2f9a75ef496d2564abb478f46a\",\n                            \"lessThan\": \"d2df29dc9abda2fc10ff522eac0969f5b77b3637\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ccf74f2390d60a2f9a75ef496d2564abb478f46a\",\n                            \"lessThan\": \"7250b6b5ba9b737cff2c2c1d0760360c7b6bca00\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ccf74f2390d60a2f9a75ef496d2564abb478f46a\",\n                            \"lessThan\": \"49aeb54e3c912ef785311264a51ab9f3698e421b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ccf74f2390d60a2f9a75ef496d2564abb478f46a\",\n                            \"lessThan\": \"5e53e285f8c989662e34d4938c728a94226bff34\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ccf74f2390d60a2f9a75ef496d2564abb478f46a\",\n                            \"lessThan\": \"990e65eb9387c4ddfa7f68782b6644c2c35d489f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ccf74f2390d60a2f9a75ef496d2564abb478f46a\",\n                            \"lessThan\": \"e054c1a6ae7310d2815778fddb87da616e11c255\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/bluetooth/iso.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.0\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.0\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.189\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.158\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.111\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.53\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1.5\",\n                            \"lessThanOrEqual\": \"7.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":8.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/d2df29dc9abda2fc10ff522eac0969f5b77b3637","https://git.kernel.org/stable/c/7250b6b5ba9b737cff2c2c1d0760360c7b6bca00","https://git.kernel.org/stable/c/49aeb54e3c912ef785311264a51ab9f3698e421b","https://git.kernel.org/stable/c/5e53e285f8c989662e34d4938c728a94226bff34","https://git.kernel.org/stable/c/990e65eb9387c4ddfa7f68782b6644c2c35d489f","https://git.kernel.org/stable/c/e054c1a6ae7310d2815778fddb87da616e11c255"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-72334","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-72334","identifiers":["CVE-2026-72334"]},"retained":false,"historicalAffected":[]}],"coverage":[]}