CVE-2026-64404

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A NULL pointer dereference exists in the Bluetooth ISO implementation. The function iso conn big sync() drops the socket lock to call hci get route() and subsequently re-acquires it. However, it dereferences iso pi(sk)->conn->hcon without verifying if conn is still valid. During the period the lock is dropped, the connection can be torn down via the sequence iso disconn cfm() -> iso conn del() -> iso chan del(), which sets iso pi(sk)->conn to NULL. This race condition is reachable through iso sock recvmsg() when using a PA-sync broadcast sink socket.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.