Skip to main content

Linux Kernel CVE-2026-72334

| EUVDEUVD-2026-59233 HIGH
2026-08-15 Linux GHSA-xw94-8v7c-8xwr
Information Disclosure Linux Red Hat Suse
8.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
8.8 HIGH
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
8.8 HIGH

Adjacent vector confirmed by Bluetooth proximity requirement; no privileges or user interaction needed to send malformed HCI-level ISO PDUs triggering kernel panic or memory corruption with high C/I/A impact.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
6.5 MEDIUM
AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 08:31 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
8.8 (HIGH)
Patch available
Aug 15, 2026 - 07:20 EUVD
CVE Published
Aug 15, 2026 - 05:55 cve.org
HIGH 8.8
CVE Published
Aug 15, 2026 - 05:55 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: fix malformed ISO_END/CONT handling

Core specification (Part C vol 4 sec 5.4.5) does not exclude empty ISO_CONT, ISO_END packets. We currently reject them if they are last.

If controller sends malformed sequence

ISO_START -> rx_len = 4, ISO_CONT skb->len 4, ISO_START

that ends payload in ISO_CONT, we leak conn->rx_skb. If controller sends too long ISO_END, we panic on skb_put. If controller sends too short ISO_END we accept it.

Fix by marking unfinished ISO_START via conn->rx_skb != NULL. Check skb->len properly before skb_put. Combine the ISO_CONT/END code paths as they require the same initial checks. Reject too short ISO_END packets.

AnalysisAI

Bluetooth ISO packet reassembly in the Linux kernel mishandles malformed ISO_CONT and ISO_END packets, exposing adjacent attackers to three distinct kernel-level impacts: a conn->rx_skb memory leak via abnormal ISO_START sequences, a kernel panic triggered by an unchecked skb_put call on oversized ISO_END frames, and silent acceptance of undersized ISO_END packets. All Linux kernel versions from 6.0 through the fix commits on affected stable branches are impacted, with fixes confirmed in 7.1.5 and 7.2-rc3. No public exploit or CISA KEV listing exists at time of analysis, but the CVSS 8.8 AV:A/PR:N vector and the availability of upstream fix commits make this an actionable patching priority for any Bluetooth-enabled Linux deployment.

Technical ContextAI

The vulnerability resides in the Linux kernel Bluetooth ISO (Isochronous) subsystem, which implements multi-packet payload reassembly for LE Audio and BLE Audio streams per Bluetooth Core Specification Part C Vol 4 §5.4.5. The reassembly engine processes ISO_START, ISO_CONT, and ISO_END PDU types into a socket buffer (skb) tracked via conn->rx_skb. Three distinct logic errors exist: (1) conn->rx_skb is not cleared when a new ISO_START arrives mid-reassembly, causing a memory leak; (2) skb_put is called without prior length bounds-checking on ISO_END frames whose payload exceeds remaining buffer space, triggering an exploitable kernel panic; (3) the ISO_END length validator was too permissive and accepted undersized payloads. No CWE is formally assigned in input data, but the root cause class combines improper input validation (analogous to CWE-20) with memory management errors (analogous to CWE-401 and CWE-787). CPE coverage is cpe:2.3:a:linux:linux:* across all kernel builds with the Bluetooth ISO subsystem compiled in.

RemediationAI

Update to Linux kernel version 7.1.5 (stable) or 7.2-rc3 and later, which incorporate fix commits 990e65eb9387c4ddfa7f68782b6644c2c35d489f (https://git.kernel.org/stable/c/990e65eb9387c4ddfa7f68782b6644c2c35d489f) and e054c1a6ae7310d2815778fddb87da616e11c255 (https://git.kernel.org/stable/c/e054c1a6ae7310d2815778fddb87da616e11c255). Distribution maintainers backporting kernel patches (Debian, Ubuntu LTS, RHEL, SUSE) should be monitored for updated kernel packages incorporating these commits. For systems that cannot be immediately patched, the most effective compensating control is disabling Bluetooth entirely via 'rfkill block bluetooth' or unloading kernel modules ('modprobe -r bluetooth bt'), which eliminates the attack surface entirely at the cost of all Bluetooth functionality. Restricting physical access to areas where untrusted individuals could come within Bluetooth range is a supplementary control with no software trade-off, but it is insufficient as a standalone measure in shared or public environments. Filtering at the OS level to prevent ISO channel establishment (if configurable via btmgmt or HCI socket restrictions) may be possible but is not confirmed as a supported workaround by the upstream fix description.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

CVE-2026-72334 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy