CVE-2026-64128

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: drop ISOEND frames received without prior ISOSTART

ISO data PDUs carry a packet-boundary flag indicating START, CONT, END or SINGLE. The ISOCONT branch of isorecv() guards against a missing ISOSTART by checking conn->rxlen before touching conn->rxskb, but ISOEND does not.

If a peer sends an ISOEND as the first packet on a fresh ISO connection, conn->rxskb is still NULL and conn->rxlen is zero, so skbput(conn->rx_skb, ...) dereferences NULL and oopses. For BIS, where receivers sync to a broadcaster without pairing, any broadcaster on the air can trigger this.

Mirror the ISOCONT check at the top of ISOEND so a stray end fragment is logged and dropped instead of crashing the host.