CVE-2026-64404: Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync()

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync()

iso_conn_big_sync() drops the socket lock to call hci_get_route() and
then re-acquires it, but dereferences iso_pi(sk)->conn->hcon afterwards
without re-checking that conn is still valid.

While the lock is dropped, the connection can be torn down under the
same socket lock: iso_disconn_cfm() -> iso_conn_del() -> iso_chan_del()
sets iso_pi(sk)->conn to NULL (and the broadcast teardown path can also
clear conn->hcon on its own). When iso_conn_big_sync() re-acquires the
lock and reads conn->hcon, conn may be NULL, causing a NULL pointer
dereference (hcon is the first member of struct iso_conn).

This path is reached from iso_sock_recvmsg() for a PA-sync broadcast
sink socket (BT_SK_DEFER_SETUP | BT_SK_PA_SYNC), so the dropped-lock
window can race with connection teardown driven by controller events.

Re-validate iso_pi(sk)->conn and its hcon after re-acquiring the socket
lock and bail out if the connection went away, as already done in the
sibling iso_sock_rebind_bc().

The Linux kernel CVE team has assigned CVE-2026-64404 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.12.6 with commit cbe640d6cae590b9a7d81ce86fe9a90e83eec1d5 and fixed in 6.12.96 with commit b3e647a4aa4d2d054f86a783f5c426035e1dc237
	Issue introduced in 6.13 with commit 7a17308c17880d259105f6e591eb1bc77b9612f0 and fixed in 6.18.39 with commit b84eeb7636d6962dd882d5e0b31475e4f404313c
	Issue introduced in 6.13 with commit 7a17308c17880d259105f6e591eb1bc77b9612f0 and fixed in 7.1.4 with commit 01afd198c2c286cd3b81f44d4e33a2e638711550
	Issue introduced in 6.13 with commit 7a17308c17880d259105f6e591eb1bc77b9612f0 and fixed in 7.2-rc3 with commit d5541eb148da72d5e0a1bca8ecd171f9fc8b366f

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64404
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/bluetooth/iso.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/b3e647a4aa4d2d054f86a783f5c426035e1dc237
	https://git.kernel.org/stable/c/b84eeb7636d6962dd882d5e0b31475e4f404313c
	https://git.kernel.org/stable/c/01afd198c2c286cd3b81f44d4e33a2e638711550
	https://git.kernel.org/stable/c/d5541eb148da72d5e0a1bca8ecd171f9fc8b366f