CVE-2026-64404: Linux Kernel Race Condition Vulnerability

CVE-2026-64404 Overview

CVE-2026-64404 is a NULL pointer dereference vulnerability in the Linux kernel's Bluetooth Isochronous Channels (ISO) subsystem. The flaw resides in the iso_conn_big_sync() function, which drops the socket lock to call hci_get_route() and then re-acquires it. After re-acquiring the lock, the function dereferences iso_pi(sk)->conn->hcon without verifying that conn remains valid. A concurrent teardown path can set iso_pi(sk)->conn to NULL during that window, triggering a kernel NULL pointer dereference. The bug is reachable from iso_sock_recvmsg() for a Periodic Advertising (PA) sync broadcast sink socket, creating a race window between userspace socket operations and controller-driven connection teardown.

Critical Impact
A local user with access to a Bluetooth PA-sync broadcast sink socket can trigger a kernel NULL pointer dereference, resulting in a denial-of-service condition on affected Linux systems.

Affected Products

Linux kernel Bluetooth subsystem (ISO channel implementation)
Distributions shipping affected upstream kernel versions prior to the referenced stable fixes
Systems with Bluetooth Low Energy (BLE) Isochronous Channels enabled

Discovery Timeline

2026-07-25 - CVE-2026-64404 published to NVD
2026-07-25 - Last updated in NVD database

Technical Details for CVE-2026-64404

Vulnerability Analysis

The vulnerability is a race condition leading to a NULL pointer dereference [CWE-476] in the Linux kernel's Bluetooth ISO socket layer. The function iso_conn_big_sync() handles Broadcast Isochronous Group (BIG) synchronization for PA-sync broadcast sink sockets. During execution, it releases the socket lock to invoke hci_get_route(), which cannot be called while holding certain locks.

While the socket lock is dropped, another kernel path can execute iso_disconn_cfm(), which calls iso_conn_del() and then iso_chan_del(). This teardown chain sets iso_pi(sk)->conn to NULL. The broadcast teardown path can also independently clear conn->hcon. When iso_conn_big_sync() reacquires the socket lock and reads conn->hcon, the conn pointer may already be NULL. Because hcon is the first member of struct iso_conn, the resulting access dereferences a NULL pointer at offset zero.

Root Cause

The root cause is missing revalidation of state after re-acquiring a lock. The dropped-lock window creates a TOCTOU (Time-of-Check to Time-of-Use) condition where the connection object referenced before the release may no longer exist after the reacquire. The sibling function iso_sock_rebind_bc() already implements the correct pattern of revalidating conn after reacquisition, but iso_conn_big_sync() omitted that check.

Attack Vector

Exploitation requires a local user with the ability to open and operate on a Bluetooth ISO socket configured with BT_SK_DEFER_SETUP and BT_SK_PA_SYNC flags. The attacker invokes iso_sock_recvmsg() on the PA-sync broadcast sink socket to reach iso_conn_big_sync(). Concurrently, a controller event or peer disconnect triggers iso_disconn_cfm(), which tears down the connection while the socket lock is briefly released. Successful races result in a kernel panic or oops, producing a denial of service.

The patch applied in the upstream fix reintroduces revalidation of iso_pi(sk)->conn and its hcon field after the socket lock is reacquired, causing the function to bail out cleanly if the connection has been destroyed.

Detection Methods for CVE-2026-64404

Indicators of Compromise

Kernel oops or panic messages referencing iso_conn_big_sync in the call stack
BUG: kernel NULL pointer dereference entries in dmesg or journalctl -k involving the Bluetooth ISO subsystem
Unexpected Bluetooth service crashes on systems using BLE Audio or broadcast sink features
Repeated process crashes tied to applications performing PA-sync operations

Detection Strategies

Monitor kernel logs for NULL pointer dereferences originating in net/bluetooth/iso.c
Correlate Bluetooth ISO socket activity with kernel crash events on endpoints with BLE Audio enabled
Track kernel version and patch level across the fleet to identify systems missing the upstream fix
Review host telemetry for unexpected kernel panics on Bluetooth-enabled workstations and IoT devices

Monitoring Recommendations

Aggregate kernel crash telemetry into a centralized logging platform for pattern analysis
Alert on repeated kernel oops events involving Bluetooth subsystem symbols
Track user-space processes that open ISO sockets and correlate with subsequent kernel faults
Maintain an inventory of Bluetooth-enabled endpoints exposing BLE Audio or broadcast sink functionality

How to Mitigate CVE-2026-64404

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the Kernel Bug Fix Commit and related stable branch updates
Update to a distribution kernel that includes the fix for iso_conn_big_sync() NULL dereference
Restrict local access on multi-user systems where untrusted users could open Bluetooth ISO sockets
Disable Bluetooth on systems that do not require it, particularly servers and infrastructure hosts

Patch Information

The fix is available in the mainline kernel and backported to stable branches. Relevant commits include Kernel Commit Summary, Kernel Commit Changes, Kernel Stability Update, and Kernel Bug Fix Commit. The patch revalidates iso_pi(sk)->conn and conn->hcon after re-acquiring the socket lock and returns early if either has become invalid, mirroring the safe pattern already used in iso_sock_rebind_bc().

Workarounds

Unload the Bluetooth kernel modules on systems where Bluetooth is not required using modprobe -r bluetooth
Blacklist Bluetooth ISO functionality where feasible until the patched kernel can be deployed
Disable BLE Audio and broadcast sink features in userspace stacks such as BlueZ where the ISO path is not needed
Limit physical access and prevent execution of untrusted binaries capable of opening Bluetooth ISO sockets