bluetooth IsoBase Overflow

Vulnerability analysis

The kernel's Bluetooth ISO layer processes LE Periodic Advertising reports and copies the report data into a fixed-size buffer (iso_pinfo->base) associated with a listening socket. The original code copied the entire report payload without validating its length or content, allowing an oversized or malformed report to overflow the destination buffer by up to several bytes. The fix adds a UUID check so that only reports carrying the Basic Audio Announcement Service UUID (0x1851) are processed, uses the EIR parsing helper to extract just the service data payload, and verifies the extracted length fits within the destination buffer before copying. An attacker with a Bluetooth 5.0+ transmitter in physical proximity can trigger the overflow by broadcasting a malicious periodic advertising packet; no authentication, pairing, or local system access is required.