PT-2026-64625 · Linux · Linux

CVE-2026-64404

·

Published

2026-07-25

·

Updated

2026-07-25

None

No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: ISO: avoid NULL deref of conn in iso conn big sync()
iso conn big sync() drops the socket lock to call hci get route() and then re-acquires it, but dereferences iso pi(sk)->conn->hcon afterwards without re-checking that conn is still valid.
While the lock is dropped, the connection can be torn down under the same socket lock: iso disconn cfm() -> iso conn del() -> iso chan del() sets iso pi(sk)->conn to NULL (and the broadcast teardown path can also clear conn->hcon on its own). When iso conn big sync() re-acquires the lock and reads conn->hcon, conn may be NULL, causing a NULL pointer dereference (hcon is the first member of struct iso conn).
This path is reached from iso sock recvmsg() for a PA-sync broadcast sink socket (BT SK DEFER SETUP | BT SK PA SYNC), so the dropped-lock window can race with connection teardown driven by controller events.
Re-validate iso pi(sk)->conn and its hcon after re-acquiring the socket lock and bail out if the connection went away, as already done in the sibling iso sock rebind bc().
Found an issue in the description? Have something to add? Feel free to write us 👾

Related Identifiers

CVE-2026-64404

Affected Products

Linux