CVE-2026-64404 - Vulnerability Details

- Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync()

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync()

iso_conn_big_sync() drops the socket lock to call hci_get_route() and
then re-acquires it, but dereferences iso_pi(sk)->conn->hcon afterwards
without re-checking that conn is still valid.

While the lock is dropped, the connection can be torn down under the
same socket lock: iso_disconn_cfm() -> iso_conn_del() -> iso_chan_del()
sets iso_pi(sk)->conn to NULL (and the broadcast teardown path can also
clear conn->hcon on its own). When iso_conn_big_sync() re-acquires the
lock and reads conn->hcon, conn may be NULL, causing a NULL pointer
dereference (hcon is the first member of struct iso_conn).

This path is reached from iso_sock_recvmsg() for a PA-sync broadcast
sink socket (BT_SK_DEFER_SETUP | BT_SK_PA_SYNC), so the dropped-lock
window can race with connection teardown driven by controller events.

Re-validate iso_pi(sk)->conn and its hcon after re-acquiring the socket
lock and bail out if the connection went away, as already done in the
sibling iso_sock_rebind_bc().

Published: 2026-07-25

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability is a race condition in iso_conn_big_sync() where the socket lock is released to call hci_get_route() and then reacquired before checking that the connection pointer is still valid. During this window the connection can be torn down, setting iso_pi(sk)->conn to NULL. When the function later dereferences iso_pi(sk)->conn->hcon it causes a NULL pointer dereference and triggers a kernel crash. This results in a denial of service. The flaw does not provide any direct remote code execution or privilege escalation path.

Affected Systems

The flaw exists in the Linux kernel’s Bluetooth ISO implementation. Any Linux system that includes the unpatched kernel code is potentially affected, regardless of distribution. No specific version numbers are listed, so all kernels built with this code before the patch are vulnerable.

Risk and Exploitability

The EPSS score is below 1% and the vulnerability is not listed in CISA’s KEV catalog, indicating a low probability of exploitation in the wild. The attack vector requires a concurrent teardown event during packet processing on an ISO socket, making reliable exploitation difficult. The primary consequence is a kernel crash leading to service disruption. Overall the risk is low to moderate, with the main mitigation being to apply the patch.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`cbe640d6cae590b9a7d81ce86fe9a90e83eec1d5`	affected	< b3e647a4aa4d2d054f86a783f5c426035e1dc237
`7a17308c17880d259105f6e591eb1bc77b9612f0`	affected	< b84eeb7636d6962dd882d5e0b31475e4f404313c
`7a17308c17880d259105f6e591eb1bc77b9612f0`	affected	< 01afd198c2c286cd3b81f44d4e33a2e638711550
`7a17308c17880d259105f6e591eb1bc77b9612f0`	affected	< d5541eb148da72d5e0a1bca8ecd171f9fc8b366f
`6.12.6`	affected	< 6.12.96

Linux

affected

Version	Status	Constraints
`6.13`	affected	—
`0`	unaffected	< 6.13
`6.12.96`	unaffected	≤ 6.12.*
`6.18.39`	unaffected	≤ 6.18.*
`7.1.4`	unaffected	≤ 7.1.*
`7.2-rc3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[cbe640d6cae590b9a7d81ce86fe9a90e83eec1d5,b3e647a4aa4d2d054f86a783f5c426035e1dc237)`	affected	code_commit	—
`[7a17308c17880d259105f6e591eb1bc77b9612f0,b84eeb7636d6962dd882d5e0b31475e4f404313c)`	affected	code_commit	—
`[7a17308c17880d259105f6e591eb1bc77b9612f0,01afd198c2c286cd3b81f44d4e33a2e638711550)`	affected	code_commit	—
`[7a17308c17880d259105f6e591eb1bc77b9612f0,d5541eb148da72d5e0a1bca8ecd171f9fc8b366f)`	affected	code_commit	—
`[6.12.6,6.12.96)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.13`	affected	generic	—
`[0,6.13)`	unaffected	semver	—
`[6.12.96,6.13.0)`	unaffected	semver	—
`[6.18.39,6.19.0)`	unaffected	semver	—
`[7.1.4,7.2.0)`	unaffected	semver	—
`[7.2-rc3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the kernel to the fixed commit via the distribution’s security channel or apply the patch from kernel.org.
If immediate patching is not possible, disable Bluetooth ISO functionality (e.g., block PA-sync broadcast sockets or turn off Bluetooth services with rfkill) until the kernel is updated.
Manually apply the patch to the kernel source tree, recompile the kernel, and install the updated binary if the distribution does not provide a timely update.

Generated by OpenCVE AI on August 2, 2026 at 12:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4724-1	linux-6.12 new package

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00168.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/01afd198c2c286cd3b81f44d4e33a2e638711550
https://git.kernel.org/stable/c/b3e647a4aa4d2d054f86a783f5c426035e1dc237
https://git.kernel.org/stable/c/b84eeb7636d6962dd882d5e0b31475e4f404313c
https://git.kernel.org/stable/c/d5541eb148da72d5e0a1bca8ecd171f9fc8b366f
https://lore.kernel.org/linux-cve-announce/2026072530-CVE-2026-64404-777e@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64404
https://www.cve.org/CVERecord?id=CVE-2026-64404

History

Sat, 01 Aug 2026 02:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-362

Thu, 30 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026072530-CVE-2026-64404-777e@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64404 https://www.cve.org/CVERecord?id=CVE-2026-64404
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Tue, 28 Jul 2026 16:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-362 CWE-476

Sat, 25 Jul 2026 09:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync() iso_conn_big_sync() drops the socket lock to call hci_get_route() and then re-acquires it, but dereferences iso_pi(sk)->conn->hcon afterwards without re-checking that conn is still valid. While the lock is dropped, the connection can be torn down under the same socket lock: iso_disconn_cfm() -> iso_conn_del() -> iso_chan_del() sets iso_pi(sk)->conn to NULL (and the broadcast teardown path can also clear conn->hcon on its own). When iso_conn_big_sync() re-acquires the lock and reads conn->hcon, conn may be NULL, causing a NULL pointer dereference (hcon is the first member of struct iso_conn). This path is reached from iso_sock_recvmsg() for a PA-sync broadcast sink socket (BT_SK_DEFER_SETUP \| BT_SK_PA_SYNC), so the dropped-lock window can race with connection teardown driven by controller events. Re-validate iso_pi(sk)->conn and its hcon after re-acquiring the socket lock and bail out if the connection went away, as already done in the sibling iso_sock_rebind_bc().
Title		Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/01afd198c2c286cd3b81f44d4e33a2e638711550 https://git.kernel.org/stable/c/b3e647a4aa4d2d054f86a783f5c426035e1dc237 https://git.kernel.org/stable/c/b84eeb7636d6962dd882d5e0b31475e4f404313c https://git.kernel.org/stable/c/d5541eb148da72d5e0a1bca8ecd171f9fc8b366f

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-25T08:50:46.523Z

Updated: 2026-07-25T08:50:46.523Z

Reserved: 2026-07-19T15:36:31.785Z

Link: CVE-2026-64404

Vulnrichment

No data.

NVD

Status : Awaiting Analysis

Published: 2026-07-25T10:17:24.003

Modified: 2026-08-11T15:01:50.637

Link: CVE-2026-64404

Redhat

Severity : Moderate

Publid Date: 2026-07-25T00:00:00Z

Links: CVE-2026-64404 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-02T13:00:05Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object