CVE-2026-64404
- Source
- https://cve.org/CVERecord?id=CVE-2026-64404
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64404.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-64404
- Downstream
- Published
- 2026-07-25T08:50:46.523Z
- Modified
- 2026-07-27T04:03:20.000689988Z
- Summary
- Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync()
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: ISO: avoid NULL deref of conn in isoconnbig_sync()
isoconnbigsync() drops the socket lock to call hcigetroute() and then re-acquires it, but dereferences isopi(sk)->conn->hcon afterwards without re-checking that conn is still valid.
While the lock is dropped, the connection can be torn down under the same socket lock: isodisconncfm() -> isoconndel() -> isochandel() sets isopi(sk)->conn to NULL (and the broadcast teardown path can also clear conn->hcon on its own). When isoconnbigsync() re-acquires the lock and reads conn->hcon, conn may be NULL, causing a NULL pointer dereference (hcon is the first member of struct iso_conn).
This path is reached from isosockrecvmsg() for a PA-sync broadcast sink socket (BTSKDEFERSETUP | BTSKPASYNC), so the dropped-lock window can race with connection teardown driven by controller events.
Re-validate isopi(sk)->conn and its hcon after re-acquiring the socket lock and bail out if the connection went away, as already done in the sibling isosockrebindbc().
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64404.json" }- References
-
- https://git.kernel.org/stable/c/01afd198c2c286cd3b81f44d4e33a2e638711550
- https://git.kernel.org/stable/c/b3e647a4aa4d2d054f86a783f5c426035e1dc237
- https://git.kernel.org/stable/c/b84eeb7636d6962dd882d5e0b31475e4f404313c
- https://git.kernel.org/stable/c/d5541eb148da72d5e0a1bca8ecd171f9fc8b366f
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64404.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-64404
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedcbe640d6cae590b9a7d81ce86fe9a90e83eec1d5Fixedb3e647a4aa4d2d054f86a783f5c426035e1dc237
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced7a17308c17880d259105f6e591eb1bc77b9612f0Fixedb84eeb7636d6962dd882d5e0b31475e4f404313cFixed01afd198c2c286cd3b81f44d4e33a2e638711550Fixedd5541eb148da72d5e0a1bca8ecd171f9fc8b366f
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced6.12.6Fixed6.12.96