CVE-2026-64404

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync()

iso_conn_big_sync() drops the socket lock to call hci_get_route() and

then re-acquires it, but dereferences iso_pi(sk)->conn->hcon afterwards

without re-checking that conn is still valid.

While the lock is dropped, the connection can be torn down under the

same socket lock: iso_disconn_cfm() -> iso_conn_del() -> iso_chan_del()

sets iso_pi(sk)->conn to NULL (and the broadcast teardown path can also

clear conn->hcon on its own). When iso_conn_big_sync() re-acquires the

lock and reads conn->hcon, conn may be NULL, causing a NULL pointer

dereference (hcon is the first member of struct iso_conn).

This path is reached from iso_sock_recvmsg() for a PA-sync broadcast

sink socket (BT_SK_DEFER_SETUP | BT_SK_PA_SYNC), so the dropped-lock

window can race with connection teardown driven by controller events.

Re-validate iso_pi(sk)->conn and its hcon after re-acqui

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References