Linux Kernel CVE-2026-64128

The vulnerability resides in the Linux kernel Bluetooth ISO layer (net/bluetooth/iso.c), which implements Isochronous Channels introduced with Bluetooth LE Audio (Bluetooth 5.2+). ISO PDUs carry a packet-boundary flag encoding one of four states: ISO_START, ISO_CONT, ISO_END, or SINGLE. The iso_recv() reassembly function guards the ISO_CONT branch by checking conn->rx_len before touching conn->rx_skb, preventing use of an uninitialized socket buffer - but the ISO_END branch lacks this same guard. CWE-476 (NULL Pointer Dereference) is triggered because conn->rx_skb remains NULL when no ISO_START has yet arrived; the unconditional skb_put(conn->rx_skb, ...) in the ISO_END path then dereferences that NULL pointer and panics the kernel. BIS (Broadcast Isochronous Stream) is particularly exposed: BIS receivers synchronize to broadcasters without pairing or connection establishment, so no trust or authentication relationship is required before a peer can deliver ISO PDUs. The CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* confirms the affected product is the mainline Linux kernel across all architectures that support Bluetooth ISO.