CVE-2026-64128

A flaw was found in the Linux kernel's Bluetooth Isochronous Stream (ISO) subsystem. A remote attacker, specifically any broadcaster on the air for Broadcast Isochronous Stream (BIS), can send a malformed Bluetooth packet (an ISO_END frame without a prior ISO_START frame) to a vulnerable system. This can lead to a null pointer dereference, causing the kernel to crash and resulting in a denial of service.

Red Hat evaluates this vulnerability as having a Moderate security impact because successful exploitation is constrained to local radio proximity and leads strictly to a kernel crash resulting in denial of service, with no compromise of data confidentiality or integrity. Standard enterprise server environments rarely utilize or enable Bluetooth hardware, significantly limiting real-world exposure across typical Red Hat Enterprise Linux deployments. Systems without Bluetooth controllers or where Bluetooth interfaces are disabled are not exposed to this issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.