The Linux kernel Bluetooth ISO data protocol uses packet-boundary flags to indicate START, CONT, END, or SINGLE packets. The iso_recv() function properly guards against missing ISO_START packets in the ISO_CONT branch by checking connection state before accessing buffers. However, the ISO_END branch lacked this check, leading to a NULL pointer dereference when an ISO_END frame is received first on a new connection. This causes a kernel crash (NULL dereference of conn->rx_skb). The vulnerability affects BIS (Broadcast Isochronous Streams) where receivers sync without pairing, allowing any broadcaster to trigger the crash. The fix mirrors the ISO_CONT check in the ISO_END branch to log and drop stray end fragments instead of crashing.

This vulnerability causes a denial of service via kernel crash (NULL pointer dereference) when a specially crafted Bluetooth ISO_END frame is received without a prior ISO_START frame. It does not impact confidentiality or integrity but results in host unavailability. Attackers within Bluetooth range can trigger this crash, affecting system stability.

A fix has been implemented in the Linux kernel to add proper checks in the ISO_END frame handling code, preventing kernel crashes by dropping invalid frames. Users should update to a Linux kernel version that includes this patch. Since no explicit patch version is provided, check the vendor or Linux kernel advisories for the fixed version. No other mitigation is indicated.