SB2026081645 - Always-Incorrect Control Flow Implementation in Linux kernel bluetooth

Description

This security bulletin contains information about 1 vulnerability.

1) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-72334)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of malformed packet sequences in the Bluetooth ISO packet reassembly logic in net/bluetooth/iso.c when processing malformed ISO_START, ISO_CONT, and ISO_END frames from a Bluetooth controller. A remote attacker can send a specially crafted sequence of malformed Bluetooth ISO frames to cause a denial of service.

The issue can lead to a kernel panic when an oversized ISO_END frame is processed, and malformed fragment sequences can also leave an unfinished receive buffer allocated.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/990e65eb9387c4ddfa7f68782b6644c2c35d489f
• https://git.kernel.org/stable/c/e054c1a6ae7310d2815778fddb87da616e11c255