{"id":"CVE-2026-64404","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync()\n\niso_conn_big_sync() drops the socket lock to call hci_get_route() and\nthen re-acquires it, but derefere…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync()\n\niso_conn_big_sync() drops the socket lock to call hci_get_route() and\nthen re-acquires it, but derefere…","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-476"],"vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 6.12.6, < 6.12.96","linux_kernel >= 6.13.1, < 6.18.39","linux_kernel >= 6.19, < 7.1.4","linux_kernel = 6.13","linux_kernel = 7.2"],"patched":["linux_kernel 7.1.4"],"published":"2026-07-25","updated":"2026-09-04","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-64404","references":[{"url":"https://git.kernel.org/stable/c/01afd198c2c286cd3b81f44d4e33a2e638711550","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b3e647a4aa4d2d054f86a783f5c426035e1dc237","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b84eeb7636d6962dd882d5e0b31475e4f404313c","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d5541eb148da72d5e0a1bca8ecd171f9fc8b366f","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd"],"epss":0.00122,"epssPercentile":0.0228,"ingestedAt":"2026-09-05T13:39:58.026Z","slug":"CVE-2026-64404","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync()\n\niso_conn_big_sync() drops the socket lock to call hci_get_route() and\nthen re-acquires it, but dereferences iso_pi(sk)->conn->hcon afterwards\nwithout re-checking that conn is still valid.\n\nWhile the lock is dropped, the connection can be torn down under the\nsame socket lock: iso_disconn_cfm() -> iso_conn_del() -> iso_chan_del()\nsets iso_pi(sk)->conn to NULL (and the broadcast teardown path can also\nclear conn->hcon on its own). When iso_conn_big_sync() re-acquires the\nlock and reads conn->hcon, conn may be NULL, causing a NULL pointer\ndereference (hcon is the first member of struct iso_conn).\n\nThis path is reached from iso_sock_recvmsg() for a PA-sync broadcast\nsink socket (BT_SK_DEFER_SETUP | BT_SK_PA_SYNC), so the dropped-lock\nwindow can race with connection teardown driven by controller events.\n\nRe-validate iso_pi(sk)->conn and its hcon after re-acquiring the socket\nlock and bail out if the connection went away, as already done in the\nsibling iso_sock_rebind_bc().\n\n## Affected\n\n- `linux_kernel >= 6.12.6, < 6.12.96`\n- `linux_kernel >= 6.13.1, < 6.18.39`\n- `linux_kernel >= 6.19, < 7.1.4`\n- `linux_kernel = 6.13`\n- `linux_kernel = 7.2`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 7.1.4`","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}