Cloudanix VulnDB

CVE-2026-98733

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel's handling of certain Bluetooth data streams can let an attacker who already has access to the computer crash it or potentially run harmful code.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Race condition in hci_queue_iso where fragmented ISO skb insertion via __skb_queue_tail occurs without holding conn->data_q.lock, allowing concurrent dequeue by the transmit worker to free the packet before the insertion completes its next-pointer update, resulting in use-after-free.

Why it matters to the business

Kernel crashes or potential code execution on Linux systems using Bluetooth ISO transport, with higher urgency for devices handling audio or other ISO traffic; low exploit maturity reduces immediate ransomware risk but still requires prompt patching within days of disclosure.

How an attack unfolds

A local attacker opens an ISO Bluetooth socket and sends fragmented packets; the socket send path races with hci_sched_iso dequeuing and freeing the skb while the insertion still writes to the old tail pointer, triggering the use-after-free reported by KASAN in hci_send_iso.

How to fix it

Apply the upstream fix that acquires conn->data_q.lock for the entire fragment batch in hci_queue_iso, matching the approach already used in hci_queue_acl; update to a patched kernel once released.

How to confirm the fix worked

Confirm the lock acquisition spans the full fragment insertion loop in hci_queue_iso; recompile with KASAN and exercise ISO send paths to verify absence of slab-use-after-free reports.

Typical attack path

  1. Obtain local user access on a Linux system with Bluetooth ISO support
  2. Create and bind an ISO socket
  3. Transmit fragmented data to trigger concurrent queue operations
  4. Leverage resulting use-after-free for memory corruption or denial of service

How to detect it

Search kernel logs and KASAN reports for use-after-free traces referencing hci_send_iso or iso_sock_sendmsg; correlate with Bluetooth socket activity from unprivileged processes shortly before crashes.

What your security team should do

  • Apply kernel updates containing the hci_queue_iso locking fix as soon as available
  • Temporarily disable Bluetooth ISO sockets if the workload permits
  • Enable kernel hardening features such as KASAN or lockdep in test environments to catch similar races
  • Monitor kernel logs for hci_send_iso related crashes

The record

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Serialize fragmented ISO packet queueing The fragmented path in hci_queue_iso() calls __skb_queue_tail() without holding conn->data_q.lock. The socket lock serializes senders, but the transmit worker can concurrently remove packets from this queue using skb_dequeue(). After an insertion saves the old tail pointer, hci_sched_iso() can dequeue that packet and pass it to the driver. The driver can free the packet before the insertion resumes and writes to the old tail's next pointer, causing a use-after-free. Concurrent updates can also corrupt the queue. KASAN reported: BUG: KASAN: slab-use-after-free in hci_send_iso+0xc7d/0xe10 Call Trace: hci_send_iso+0xc7d/0xe10 iso_sock_sendmsg+0x710/0x900 __sys_sendto+0x34a/0x3a0 Allocated by task 86: __alloc_skb+0xdd/0x820 alloc_skb_with_frags+0x7e/0x770 sock_alloc_send_pskb+0x67a/0x820 bt_skb_sendmsg.constprop.0+0xc0/0x6c0 iso_sock_sendmsg+0x44e/0x900 Freed by task 90: kmem_cache_free+0xcb/0x3d0 vhci_read+0x33f/0x4d0 vfs_read+0x177/0xa20 Hold the queue lock across the entire fragment batch, as hci_queue_acl() does, to serialize insertion against dequeue while preserving fragment ordering.

Affected packages

Ecosystem Package Introduced Fixed