PT-2026-64625 · Linux · Linux

CVE-2026-64404

·

Publicado

2026-07-25

·

Atualizado

2026-07-25

Nenhuma

Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: ISO: avoid NULL deref of conn in iso conn big sync()
iso conn big sync() drops the socket lock to call hci get route() and then re-acquires it, but dereferences iso pi(sk)->conn->hcon afterwards without re-checking that conn is still valid.
While the lock is dropped, the connection can be torn down under the same socket lock: iso disconn cfm() -> iso conn del() -> iso chan del() sets iso pi(sk)->conn to NULL (and the broadcast teardown path can also clear conn->hcon on its own). When iso conn big sync() re-acquires the lock and reads conn->hcon, conn may be NULL, causing a NULL pointer dereference (hcon is the first member of struct iso conn).
This path is reached from iso sock recvmsg() for a PA-sync broadcast sink socket (BT SK DEFER SETUP | BT SK PA SYNC), so the dropped-lock window can race with connection teardown driven by controller events.
Re-validate iso pi(sk)->conn and its hcon after re-acquiring the socket lock and bail out if the connection went away, as already done in the sibling iso sock rebind bc().
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Identificadores relacionados

CVE-2026-64404

Produtos afetados

Linux