---
id: CVE-2026-64404
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync()

  iso_conn_big_sync() drops the socket lock to call hci_get_route() and
  then re-acquires it, but derefere…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync()

  iso_conn_big_sync() drops the socket lock to call hci_get_route() and
  then re-acquires it, but derefere…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-476
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 6.12.6, < 6.12.96'
  - 'linux_kernel >= 6.13.1, < 6.18.39'
  - 'linux_kernel >= 6.19, < 7.1.4'
  - linux_kernel = 6.13
  - linux_kernel = 7.2
patched:
  - linux_kernel 7.1.4
published: '2026-07-25'
updated: '2026-09-04'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-64404'
references:
  - url: 'https://git.kernel.org/stable/c/01afd198c2c286cd3b81f44d4e33a2e638711550'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b3e647a4aa4d2d054f86a783f5c426035e1dc237'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b84eeb7636d6962dd882d5e0b31475e4f404313c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d5541eb148da72d5e0a1bca8ecd171f9fc8b366f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
epss: 0.00162
epssPercentile: 0.04653
ingestedAt: '2026-09-05T13:39:58.026Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync()

iso_conn_big_sync() drops the socket lock to call hci_get_route() and
then re-acquires it, but dereferences iso_pi(sk)->conn->hcon afterwards
without re-checking that conn is still valid.

While the lock is dropped, the connection can be torn down under the
same socket lock: iso_disconn_cfm() -> iso_conn_del() -> iso_chan_del()
sets iso_pi(sk)->conn to NULL (and the broadcast teardown path can also
clear conn->hcon on its own). When iso_conn_big_sync() re-acquires the
lock and reads conn->hcon, conn may be NULL, causing a NULL pointer
dereference (hcon is the first member of struct iso_conn).

This path is reached from iso_sock_recvmsg() for a PA-sync broadcast
sink socket (BT_SK_DEFER_SETUP | BT_SK_PA_SYNC), so the dropped-lock
window can race with connection teardown driven by controller events.

Re-validate iso_pi(sk)->conn and its hcon after re-acquiring the socket
lock and bail out if the connection went away, as already done in the
sibling iso_sock_rebind_bc().

## Affected

- `linux_kernel >= 6.12.6, < 6.12.96`
- `linux_kernel >= 6.13.1, < 6.18.39`
- `linux_kernel >= 6.19, < 7.1.4`
- `linux_kernel = 6.13`
- `linux_kernel = 7.2`

## Remediation

Upgrade past the affected range:

- `linux_kernel 7.1.4`