The Linux kernel Bluetooth ISO subsystem mishandles ISO_END frames received without a prior ISO_START frame. Specifically, the iso_recv() function processes ISO data PDUs with packet-boundary flags (START, CONT, END, SINGLE). While the ISO_CONT branch checks for a valid connection state before accessing the receive buffer, the ISO_END branch does not, leading to a NULL pointer dereference and kernel oops if an ISO_END frame is the first packet on a new ISO connection. This can be triggered by any broadcaster in Broadcast Isochronous Stream (BIS) mode, where receivers sync without pairing. The fix mirrors the ISO_CONT check in the ISO_END branch to log and drop such frames instead of crashing the kernel.

A remote attacker broadcasting ISO_END frames without prior ISO_START frames can cause a denial of service by crashing the Linux kernel on affected systems. This impacts system stability and availability but does not indicate code execution or privilege escalation from the provided data.

A fix has been implemented in the Linux kernel to add proper checks in the ISO_END frame handling code, preventing kernel crashes by dropping invalid frames. Users should apply the official kernel updates that include this fix. Patch status is not explicitly stated here; check the Linux kernel vendor advisory for the exact fixed versions and update accordingly.