The Linux kernel Bluetooth ISO subsystem's iso_conn_big_sync() function improperly dereferences a connection pointer after dropping and re-acquiring a socket lock without re-checking the pointer's validity. During the lock drop, the connection can be torn down, setting the pointer to NULL. When iso_conn_big_sync() resumes, it accesses this NULL pointer, causing a NULL pointer dereference. This issue affects PA-sync broadcast sink sockets and arises from a race condition between connection teardown and message reception. The fix involves re-validating the connection pointer after re-acquiring the lock and aborting if the connection is no longer valid.

This vulnerability can lead to a NULL pointer dereference in the Linux kernel Bluetooth ISO code, which may cause a kernel crash or denial of service. There is no information about code execution or privilege escalation. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability description indicates that a fix has been implemented by adding a re-validation check after re-acquiring the socket lock. Users should monitor official Linux kernel updates and apply patches when available.