CVE-2026-64405

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()

hci_abort_conn() read hci_skb_event(hdev->sent_cmd) when a connection

was pending, but hdev->sent_cmd can be NULL while req_status is still

HCI_REQ_PEND, leading to a NULL pointer dereference and a general

protection fault from the hci_rx_work() receive path.

Instead of inspecting hdev->sent_cmd, track the in-flight create

connection command with a new per-connection HCI_CONN_CREATE flag and

route all cancellation through hci_cancel_connect_sync(), which

dispatches to a dedicated per-type cancel function. The create command

is in exactly one of two states: still queued, or in flight. The cancel

function holds cmd_sync_work_lock across the whole decision: the worker

takes this lock to dequeue every entry, so while it is held a queued

command cannot start running and an in-flight command cannot complete

and let the next command become pending. This keeps the

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References