{
  "advisories": [
    {
      "id": "USN-8593-1",
      "source": "usn",
      "title": "Linux kernel vulnerabilities",
      "url": "https://ubuntu.com/security/notices/USN-8593-1"
    },
    {
      "id": "USN-8603-1",
      "source": "usn",
      "title": "Linux kernel (Azure) vulnerabilities",
      "url": "https://ubuntu.com/security/notices/USN-8603-1"
    },
    {
      "id": "USN-8618-1",
      "source": "usn",
      "title": "Linux kernel vulnerabilities",
      "url": "https://ubuntu.com/security/notices/USN-8618-1"
    },
    {
      "id": "USN-8663-1",
      "source": "usn",
      "title": "Linux kernel (NVIDIA) vulnerabilities",
      "url": "https://ubuntu.com/security/notices/USN-8663-1"
    },
    {
      "id": "USN-8664-1",
      "source": "usn",
      "title": "Linux kernel (NVIDIA BaseOS) vulnerabilities",
      "url": "https://ubuntu.com/security/notices/USN-8664-1"
    },
    {
      "id": "USN-8728-1",
      "source": "usn",
      "title": "Linux kernel (GCP) vulnerabilities",
      "url": "https://ubuntu.com/security/notices/USN-8728-1"
    },
    {
      "id": "USN-8729-1",
      "source": "usn",
      "title": "Linux kernel vulnerabilities",
      "url": "https://ubuntu.com/security/notices/USN-8729-1"
    },
    {
      "id": "USN-8761-1",
      "source": "usn",
      "title": "Linux kernel (Azure) vulnerabilities",
      "url": "https://ubuntu.com/security/notices/USN-8761-1"
    },
    {
      "id": "USN-8729-2",
      "source": "usn",
      "title": "Linux kernel (Raspberry Pi Real-time) vulnerabilities",
      "url": "https://ubuntu.com/security/notices/USN-8729-2"
    },
    {
      "id": "USN-8761-2",
      "source": "usn",
      "title": "Linux kernel (Azure FIPS) vulnerabilities",
      "url": "https://ubuntu.com/security/notices/USN-8761-2"
    },
    {
      "id": "USN-8781-1",
      "source": "usn",
      "title": "Linux kernel (NVIDIA Tegra) vulnerabilities",
      "url": "https://ubuntu.com/security/notices/USN-8781-1"
    },
    {
      "id": "USN-8729-3",
      "source": "usn",
      "title": "Linux kernel vulnerabilities",
      "url": "https://ubuntu.com/security/notices/USN-8729-3"
    },
    {
      "id": "USN-8802-1",
      "source": "usn",
      "title": "Linux kernel (Oracle) vulnerabilities",
      "url": "https://ubuntu.com/security/notices/USN-8802-1"
    },
    {
      "id": "USN-8728-2",
      "source": "usn",
      "title": "Linux kernel (Azure) vulnerabilities",
      "url": "https://ubuntu.com/security/notices/USN-8728-2"
    },
    {
      "id": "USN-8729-4",
      "source": "usn",
      "title": "Linux kernel (Low Latency) vulnerabilities",
      "url": "https://ubuntu.com/security/notices/USN-8729-4"
    },
    {
      "id": "USN-8729-5",
      "source": "usn",
      "title": "Linux kernel (AWS FIPS) vulnerabilities",
      "url": "https://ubuntu.com/security/notices/USN-8729-5"
    }
  ],
  "cve": "CVE-2026-64128",
  "enrichment": {
    "affected": [
      {
        "configurations": [
          {
            "platform": null,
            "status": "affected",
            "versions": {
              "scheme": "code_commit",
              "value": "[ccf74f2390d60a2f9a75ef496d2564abb478f46a,1c3d1e1696b72579b970e17999c503a14535205b)"
            }
          },
          {
            "platform": null,
            "status": "affected",
            "versions": {
              "scheme": "code_commit",
              "value": "[ccf74f2390d60a2f9a75ef496d2564abb478f46a,3af41ee7ebecb0d5c8a504861f6cfad31345310f)"
            }
          },
          {
            "platform": null,
            "status": "affected",
            "versions": {
              "scheme": "code_commit",
              "value": "[ccf74f2390d60a2f9a75ef496d2564abb478f46a,39f4a82e80c8f5ed2d6952d73fbafc895721a728)"
            }
          },
          {
            "platform": null,
            "status": "affected",
            "versions": {
              "scheme": "code_commit",
              "value": "[ccf74f2390d60a2f9a75ef496d2564abb478f46a,61f2410a96dee808029e2ae4d6ef2dd635f3477f)"
            }
          },
          {
            "platform": null,
            "status": "affected",
            "versions": {
              "scheme": "code_commit",
              "value": "[ccf74f2390d60a2f9a75ef496d2564abb478f46a,e3a799881c12d27596232636a607e2e3fa448d63)"
            }
          },
          {
            "platform": null,
            "status": "affected",
            "versions": {
              "scheme": "code_commit",
              "value": "[ccf74f2390d60a2f9a75ef496d2564abb478f46a,84c24fb151fc1179355296d7ff29129ac7c42129)"
            }
          }
        ],
        "enrichment": {
          "confidence": 99.0,
          "confidence_source": "inferred",
          "scores": [
            {
              "score": 99.0,
              "source": "inferred"
            },
            {
              "score": 100.0,
              "source": "matching"
            }
          ]
        },
        "original": {
          "product": "Linux",
          "source": "cna",
          "vendor": "Linux"
        },
        "product": "linux_kernel",
        "vendor": "linux"
      },
      {
        "configurations": [
          {
            "platform": null,
            "status": "affected",
            "versions": {
              "scheme": "semver",
              "value": "6.0"
            }
          },
          {
            "platform": null,
            "status": "unaffected",
            "versions": {
              "scheme": "semver",
              "value": "[0,6.0)"
            }
          },
          {
            "platform": null,
            "status": "unaffected",
            "versions": {
              "scheme": "semver",
              "value": "[6.1.175,6.2.0)"
            }
          },
          {
            "platform": null,
            "status": "unaffected",
            "versions": {
              "scheme": "semver",
              "value": "[6.6.142,6.7.0)"
            }
          },
          {
            "platform": null,
            "status": "unaffected",
            "versions": {
              "scheme": "semver",
              "value": "[6.12.92,6.13.0)"
            }
          },
          {
            "platform": null,
            "status": "unaffected",
            "versions": {
              "scheme": "semver",
              "value": "[6.18.34,6.19.0)"
            }
          },
          {
            "platform": null,
            "status": "unaffected",
            "versions": {
              "scheme": "semver",
              "value": "[7.0.11,7.1.0)"
            }
          },
          {
            "platform": null,
            "status": "unaffected",
            "versions": {
              "scheme": "generic",
              "value": "[7.1,*]"
            }
          }
        ],
        "enrichment": {
          "confidence": 99.0,
          "confidence_source": "inferred",
          "scores": [
            {
              "score": 99.0,
              "source": "inferred"
            },
            {
              "score": 100.0,
              "source": "matching"
            }
          ]
        },
        "original": {
          "product": "Linux",
          "source": "cna",
          "vendor": "Linux"
        },
        "product": "linux_kernel",
        "vendor": "linux"
      }
    ],
    "created": "2026-07-21T20:00:06.144436+00:00",
    "updated": "2026-07-30T20:30:04.647420+00:00",
    "vendors": [
      "linux",
      "linux$PRODUCT$linux_kernel"
    ]
  },
  "epss": {
    "score": 0.00162
  },
  "mitre": {
    "cpes": [
      "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"
    ],
    "created": "2026-07-19T15:40:24.678000+00:00",
    "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: drop ISO_END frames received without prior ISO_START\n\nISO data PDUs carry a packet-boundary flag indicating START, CONT, END\nor SINGLE. The ISO_CONT branch of iso_recv() guards against a missing\nISO_START by checking conn->rx_len before touching conn->rx_skb, but\nISO_END does not.\n\nIf a peer sends an ISO_END as the first packet on a fresh ISO\nconnection, conn->rx_skb is still NULL and conn->rx_len is zero, so\nskb_put(conn->rx_skb, ...) dereferences NULL and oopses. For BIS,\nwhere receivers sync to a broadcaster without pairing, any broadcaster\non the air can trigger this.\n\nMirror the ISO_CONT check at the top of ISO_END so a stray end fragment\nis logged and dropped instead of crashing the host.",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {},
      "cvssV4_0": {}
    },
    "mitre_repo_path": "cves/2026/64xxx/CVE-2026-64128.json",
    "references": [
      "https://git.kernel.org/stable/c/1c3d1e1696b72579b970e17999c503a14535205b",
      "https://git.kernel.org/stable/c/39f4a82e80c8f5ed2d6952d73fbafc895721a728",
      "https://git.kernel.org/stable/c/3af41ee7ebecb0d5c8a504861f6cfad31345310f",
      "https://git.kernel.org/stable/c/61f2410a96dee808029e2ae4d6ef2dd635f3477f",
      "https://git.kernel.org/stable/c/84c24fb151fc1179355296d7ff29129ac7c42129",
      "https://git.kernel.org/stable/c/e3a799881c12d27596232636a607e2e3fa448d63"
    ],
    "title": "Bluetooth: ISO: drop ISO_END frames received without prior ISO_START",
    "updated": "2026-07-19T15:40:24.678000+00:00",
    "vendors": [
      "linux",
      "linux$PRODUCT$linux_kernel"
    ],
    "weaknesses": []
  },
  "nvd": {
    "cpes": [
      "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
      "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*",
      "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*",
      "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*",
      "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*"
    ],
    "created": "2026-07-19T16:17:54.510000+00:00",
    "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: drop ISO_END frames received without prior ISO_START\n\nISO data PDUs carry a packet-boundary flag indicating START, CONT, END\nor SINGLE. The ISO_CONT branch of iso_recv() guards against a missing\nISO_START by checking conn->rx_len before touching conn->rx_skb, but\nISO_END does not.\n\nIf a peer sends an ISO_END as the first packet on a fresh ISO\nconnection, conn->rx_skb is still NULL and conn->rx_len is zero, so\nskb_put(conn->rx_skb, ...) dereferences NULL and oopses. For BIS,\nwhere receivers sync to a broadcaster without pairing, any broadcaster\non the air can trigger this.\n\nMirror the ISO_CONT check at the top of ISO_END so a stray end fragment\nis logged and dropped instead of crashing the host.",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {
        "score": 5.5,
        "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
      },
      "cvssV4_0": {}
    },
    "nvd_repo_path": "2026/CVE-2026-64128.json",
    "references": [
      "https://git.kernel.org/stable/c/1c3d1e1696b72579b970e17999c503a14535205b",
      "https://git.kernel.org/stable/c/39f4a82e80c8f5ed2d6952d73fbafc895721a728",
      "https://git.kernel.org/stable/c/3af41ee7ebecb0d5c8a504861f6cfad31345310f",
      "https://git.kernel.org/stable/c/61f2410a96dee808029e2ae4d6ef2dd635f3477f",
      "https://git.kernel.org/stable/c/84c24fb151fc1179355296d7ff29129ac7c42129",
      "https://git.kernel.org/stable/c/e3a799881c12d27596232636a607e2e3fa448d63"
    ],
    "title": null,
    "updated": "2026-08-13T15:11:03.127000+00:00",
    "vendors": [
      "linux",
      "linux$PRODUCT$linux_kernel"
    ],
    "weaknesses": [
      "CWE-476"
    ]
  },
  "opencve": {
    "changes": [
      {
        "created": "2026-07-19T16:15:00+00:00",
        "data": [
          {
            "details": {
              "new": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: drop ISO_END frames received without prior ISO_START\n\nISO data PDUs carry a packet-boundary flag indicating START, CONT, END\nor SINGLE. The ISO_CONT branch of iso_recv() guards against a missing\nISO_START by checking conn->rx_len before touching conn->rx_skb, but\nISO_END does not.\n\nIf a peer sends an ISO_END as the first packet on a fresh ISO\nconnection, conn->rx_skb is still NULL and conn->rx_len is zero, so\nskb_put(conn->rx_skb, ...) dereferences NULL and oopses. For BIS,\nwhere receivers sync to a broadcaster without pairing, any broadcaster\non the air can trigger this.\n\nMirror the ISO_CONT check at the top of ISO_END so a stray end fragment\nis logged and dropped instead of crashing the host.",
              "old": null
            },
            "type": "description"
          },
          {
            "details": {
              "new": "Bluetooth: ISO: drop ISO_END frames received without prior ISO_START",
              "old": null
            },
            "type": "title"
          },
          {
            "details": [
              "linux",
              "linux$PRODUCT$linux_kernel"
            ],
            "type": "first_time"
          },
          {
            "details": {
              "added": [
                "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"
              ],
              "removed": []
            },
            "type": "cpes"
          },
          {
            "details": {
              "added": [
                "linux",
                "linux$PRODUCT$linux_kernel"
              ],
              "removed": []
            },
            "type": "vendors"
          },
          {
            "details": {
              "added": [
                "https://git.kernel.org/stable/c/1c3d1e1696b72579b970e17999c503a14535205b",
                "https://git.kernel.org/stable/c/39f4a82e80c8f5ed2d6952d73fbafc895721a728",
                "https://git.kernel.org/stable/c/3af41ee7ebecb0d5c8a504861f6cfad31345310f",
                "https://git.kernel.org/stable/c/61f2410a96dee808029e2ae4d6ef2dd635f3477f",
                "https://git.kernel.org/stable/c/84c24fb151fc1179355296d7ff29129ac7c42129",
                "https://git.kernel.org/stable/c/e3a799881c12d27596232636a607e2e3fa448d63"
              ],
              "removed": []
            },
            "type": "references"
          }
        ],
        "id": "3e06ecbb-c081-46ab-b8e0-e9e5a0643dde"
      },
      {
        "created": "2026-07-20T12:15:00+00:00",
        "data": [
          {
            "details": {
              "added": [
                "CWE-476"
              ],
              "removed": []
            },
            "type": "weaknesses"
          },
          {
            "details": {
              "added": [
                "https://lore.kernel.org/linux-cve-announce/2026071926-CVE-2026-64128-f336@gregkh/T",
                "https://nvd.nist.gov/vuln/detail/CVE-2026-64128",
                "https://www.cve.org/CVERecord?id=CVE-2026-64128"
              ],
              "removed": []
            },
            "type": "references"
          },
          {
            "details": {
              "added": {
                "cvssV3_1": {
                  "score": 5.5,
                  "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
                }
              },
              "removed": {},
              "updated": {
                "threat_severity": {
                  "new": "Moderate",
                  "old": null
                }
              }
            },
            "type": "metrics"
          }
        ],
        "id": "103d03c2-4274-4ad8-8984-7d7f70e23545"
      },
      {
        "created": "2026-08-13T15:30:00+00:00",
        "data": [
          {
            "details": {
              "added": [
                "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*",
                "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*",
                "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*",
                "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*"
              ],
              "removed": []
            },
            "type": "cpes"
          }
        ],
        "id": "7c285c4e-a975-40ad-bcf7-3a9c2c561927"
      }
    ],
    "cpes": {
      "data": [
        "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
        "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*",
        "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*",
        "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*",
        "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*"
      ],
      "providers": [
        "mitre",
        "nvd"
      ]
    },
    "created": {
      "data": "2026-07-19T00:00:00+00:00",
      "provider": "redhat"
    },
    "description": {
      "data": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: drop ISO_END frames received without prior ISO_START\n\nISO data PDUs carry a packet-boundary flag indicating START, CONT, END\nor SINGLE. The ISO_CONT branch of iso_recv() guards against a missing\nISO_START by checking conn->rx_len before touching conn->rx_skb, but\nISO_END does not.\n\nIf a peer sends an ISO_END as the first packet on a fresh ISO\nconnection, conn->rx_skb is still NULL and conn->rx_len is zero, so\nskb_put(conn->rx_skb, ...) dereferences NULL and oopses. For BIS,\nwhere receivers sync to a broadcaster without pairing, any broadcaster\non the air can trigger this.\n\nMirror the ISO_CONT check at the top of ISO_END so a stray end fragment\nis logged and dropped instead of crashing the host.",
      "provider": "mitre"
    },
    "metrics": {
      "cvssV2_0": {
        "data": {},
        "provider": null
      },
      "cvssV3_0": {
        "data": {},
        "provider": null
      },
      "cvssV3_1": {
        "data": {
          "score": 5.5,
          "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
        },
        "provider": "nvd"
      },
      "cvssV4_0": {
        "data": {},
        "provider": null
      },
      "epss": {
        "data": {
          "score": 0.00162
        },
        "provider": "first"
      },
      "kev": {
        "data": {},
        "provider": null
      },
      "ssvc": {
        "data": {},
        "provider": null
      },
      "threat_severity": {
        "data": "Moderate",
        "provider": "redhat"
      }
    },
    "references": {
      "data": [
        "https://git.kernel.org/stable/c/1c3d1e1696b72579b970e17999c503a14535205b",
        "https://git.kernel.org/stable/c/39f4a82e80c8f5ed2d6952d73fbafc895721a728",
        "https://git.kernel.org/stable/c/3af41ee7ebecb0d5c8a504861f6cfad31345310f",
        "https://git.kernel.org/stable/c/61f2410a96dee808029e2ae4d6ef2dd635f3477f",
        "https://git.kernel.org/stable/c/84c24fb151fc1179355296d7ff29129ac7c42129",
        "https://git.kernel.org/stable/c/e3a799881c12d27596232636a607e2e3fa448d63",
        "https://lore.kernel.org/linux-cve-announce/2026071926-CVE-2026-64128-f336@gregkh/T",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-64128",
        "https://www.cve.org/CVERecord?id=CVE-2026-64128"
      ],
      "providers": [
        "mitre",
        "nvd",
        "redhat"
      ]
    },
    "title": {
      "data": "Bluetooth: ISO: drop ISO_END frames received without prior ISO_START",
      "provider": "mitre"
    },
    "updated": {
      "data": "2026-08-13T15:11:03.127000+00:00",
      "provider": "nvd"
    },
    "vendors": {
      "data": [
        "linux",
        "linux$PRODUCT$linux_kernel"
      ],
      "providers": [
        "mitre",
        "nvd",
        "enrichment"
      ]
    },
    "weaknesses": {
      "data": [
        "CWE-476"
      ],
      "providers": [
        "nvd",
        "redhat"
      ]
    }
  },
  "redhat": {
    "cpes": [],
    "created": "2026-07-19T00:00:00+00:00",
    "description": "A flaw was found in the Linux kernel's Bluetooth Isochronous Stream (ISO) subsystem. A remote attacker, specifically any broadcaster on the air for Broadcast Isochronous Stream (BIS), can send a malformed Bluetooth packet (an ISO_END frame without a prior ISO_START frame) to a vulnerable system. This can lead to a null pointer dereference, causing the kernel to crash and resulting in a denial of service.",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {
        "score": 5.5,
        "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
      },
      "threat_severity": "Moderate"
    },
    "redhat_repo_path": "2026/CVE-2026-64128.json",
    "references": [
      "https://lore.kernel.org/linux-cve-announce/2026071926-CVE-2026-64128-f336@gregkh/T",
      "https://nvd.nist.gov/vuln/detail/CVE-2026-64128",
      "https://www.cve.org/CVERecord?id=CVE-2026-64128"
    ],
    "title": "kernel: Bluetooth: ISO: drop ISO_END frames received without prior ISO_START",
    "updated": "2026-07-19T00:00:00+00:00",
    "vendors": [],
    "weaknesses": [
      "CWE-476"
    ]
  }
}