CVE-2026-72334

A flaw was found in the Linux kernel's Bluetooth ISO (Isochronous Stream) handling. A remote attacker, by sending specially crafted malformed Bluetooth ISO packets, could trigger a kernel panic, leading to a denial of service. Additionally, this vulnerability could result in a memory leak within the kernel. This issue arises from improper handling of ISO_END and ISO_CONT packets, particularly when they are malformed or unexpected.

Malformed Bluetooth ISO fragmentation can leave conn rx_skb allocated or can drive iso_recv into skb_put with an excessive ISO_END length, leading to a kernel panic. A malformed sequence such as ISO_START, ISO_CONT, ISO_START can leak the receive skb, while an overlong ISO_END can crash the host and a too short ISO_END may be accepted incorrectly. For the CVSS the PR:N is used for the paranoid score because an attacker does not need local privileges if malformed ISO data can be delivered over an adjacent Bluetooth link or through an exposed HCI controller path. The issue is not Internet reachable but it is adjacent network reachable for Bluetooth capable targets and practical exploitation depends on ISO support, controller behavior, and the ability to influence malformed ISO fragments. Impact is denial of service via resource leak or kernel crash, with no supported evidence of privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.