Linux Kernel: Bluetooth ISO buffer handling flaw in periodic advertisement processing
Summary
The Bluetooth ISO component of the Linux kernel copies periodic advertisement report data into the BASE structure without checking that the service UUID is the Basic Audio Announcement Service UUID. An attacker within Bluetooth radio range can send crafted advertisements without authentication. The primary sources confirm a restriction on copied data, and most likely the impact is a denial of service (kernel crash); code execution is not confirmed.
Affected
- Linux kernel ranges according to the CNA record: from e4cfffb5ebc80820f46cf16a6fa5be1b436bdf2d up to the fix commits, and 6.1.159 to < 6.1.178.
- Kernel 6.6 before 6.6.145 (OSV: introduced in 6.2.0, fixed in 6.1.178 and 6.6.145).
- Exact affected distribution kernel versions: Unknown.
Fixed in
- Linux stable kernels 6.1.178 and 6.6.145 and later (kernel.org commits ba25efe15e8fd909884e113a86c6ccd07d88256e, 927ef409f713929dea2b9a5ed5bb65e712be0050, f4da3ee15de9944482382181329bb6d7335ca003).
- Distribution fix versions: Unknown.
Workaround
- No vendor workaround known.
- On systems without Bluetooth requirements, disable or blacklist the Bluetooth kernel modules (not vendor-sourced).
Exploitation
- Not listed in CISA KEV. EPSS below 1 percent.
- VulDB reports no exploit available.
- No public proof of concept or in-the-wild exploitation known.
Our recommendation
- Update Linux kernels with Bluetooth hardware to 6.1.178 or 6.6.145 or later, or to the patched version from your distribution.
- Verify that your distribution kernel actually contains the fix commits.
- Prioritise laptops, workstations and mobile devices with Bluetooth enabled.
- Disable Bluetooth on servers and fixed systems where it is not needed.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Linux stable commit 927ef409f713929dea2b9a5ed5bb65e712be0050 git.kernel.org
- Linux stable commit ba25efe15e8fd909884e113a86c6ccd07d88256e git.kernel.org
- Linux stable commit f4da3ee15de9944482382181329bb6d7335ca003 git.kernel.org
- Ubuntu CVE-2023-7356 ubuntu.com
- VulDB 424846 vuldb.com
- OSV CVE-2023-7356 (Vulners) vulners.com
- Strix CVE-2023-7356 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 11:14.
Original description (NVD)
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID Copy the content of a Periodic Advertisement Report to BASE only if the service UUID is Basic Audio Announcement Service UUID.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.