PT-2026-64625 · Linux · Linux
CVE-2026-64404
·
Published
2026-07-25
·
Updated
2026-07-25
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: ISO: avoid NULL deref of conn in iso conn big sync()
iso conn big sync() drops the socket lock to call hci get route() and
then re-acquires it, but dereferences iso pi(sk)->conn->hcon afterwards
without re-checking that conn is still valid.
While the lock is dropped, the connection can be torn down under the
same socket lock: iso disconn cfm() -> iso conn del() -> iso chan del()
sets iso pi(sk)->conn to NULL (and the broadcast teardown path can also
clear conn->hcon on its own). When iso conn big sync() re-acquires the
lock and reads conn->hcon, conn may be NULL, causing a NULL pointer
dereference (hcon is the first member of struct iso conn).
This path is reached from iso sock recvmsg() for a PA-sync broadcast
sink socket (BT SK DEFER SETUP | BT SK PA SYNC), so the dropped-lock
window can race with connection teardown driven by controller events.
Re-validate iso pi(sk)->conn and its hcon after re-acquiring the socket
lock and bail out if the connection went away, as already done in the
sibling iso sock rebind bc().
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux