CyberRota Analysis
AI-GeneratedThe vulnerability affects the Linux kernel's Bluetooth implementation, specifically in the handling of ISO_END frames that are received without a corresponding ISO_START frame. This flaw can lead to a null pointer dereference, potentially causing the system to crash when a malicious broadcaster sends an ISO_END packet on a new ISO connection. Organizations using Linux systems with Bluetooth capabilities should prioritize addressing this vulnerability to maintain system stability and security.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: drop ISO_END frames received without prior ISO_START ISO data PDUs carry a packet-boundary flag indicating START, CONT, END or SINGLE. The ISO_CONT branch of iso_recv() guards against a missing ISO_START by checking conn->rx_len before touching conn->rx_skb, but ISO_END does not. If a peer sends an ISO_END as the first packet on a fresh ISO connection, conn->rx_skb is still NULL and conn->rx_len is zero, so skb_put(conn->rx_skb, ...) dereferences NULL and oopses. For BIS, where receivers sync to a broadcaster without pairing, any broadcaster on the air can trigger this. Mirror the ISO_CONT check at the top of ISO_END so a stray end fragment is logged and dropped instead of crashing the host.
Related CVEs
Other vulnerabilities affecting the same vendor(s)