CVE-2026-64404

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync()<br /> <br /> iso_conn_big_sync() drops the socket lock to call hci_get_route() and<br /> then re-acquires it, but dereferences iso_pi(sk)-&gt;conn-&gt;hcon afterwards<br /> without re-checking that conn is still valid.<br /> <br /> While the lock is dropped, the connection can be torn down under the<br /> same socket lock: iso_disconn_cfm() -&gt; iso_conn_del() -&gt; iso_chan_del()<br /> sets iso_pi(sk)-&gt;conn to NULL (and the broadcast teardown path can also<br /> clear conn-&gt;hcon on its own). When iso_conn_big_sync() re-acquires the<br /> lock and reads conn-&gt;hcon, conn may be NULL, causing a NULL pointer<br /> dereference (hcon is the first member of struct iso_conn).<br /> <br /> This path is reached from iso_sock_recvmsg() for a PA-sync broadcast<br /> sink socket (BT_SK_DEFER_SETUP | BT_SK_PA_SYNC), so the dropped-lock<br /> window can race with connection teardown driven by controller events.<br /> <br /> Re-validate iso_pi(sk)-&gt;conn and its hcon after re-acquiring the socket<br /> lock and bail out if the connection went away, as already done in the<br /> sibling iso_sock_rebind_bc().