Executive brief
A vulnerability was identified in the Linux kernel's Bluetooth subsystem that could lead to a system crash. The issue occurs when the system attempts to synchronize Bluetooth broadcast audio connections, where a specific internal reference can become invalid while the system is processing other tasks. This could result in a 'NULL pointer dereference,' causing the operating system to stop functioning unexpectedly.
Technical details
A race condition exists in net/bluetooth/iso.c within the iso_conn_big_sync() function. The function drops the socket lock to call hci_get_route() and subsequently re-acquires it, but fails to re-validate that iso_pi(sk)->conn is still valid before dereferencing it. During the period the lock is dropped, the connection can be torn down by controller events (e.g., via iso_chan_del), setting the pointer to NULL. An attacker or specific timing of controller events can trigger a NULL pointer dereference when the function resumes. This affects PA-sync broadcast sink sockets using BT_SK_DEFER_SETUP and BT_SK_PA_SYNC. Patches have been released for various stable kernel branches including 6.12.y, 6.18.y, and 7.1.y.
Affected products
- Linux Linux Kernel 6.12.6 to 6.12.96, 6.13, 6.18.39, 7.1.4
Timeline
- 2026-06-21: disclosed: Initial patch authored by Muhammad Bilal
- 2026-07-18: patched: Patch committed to stable tree by Greg Kroah-Hartman
- 2026-07-25: advisory: CVE published in NVD dataset