Cloudanix VulnDB

CVE-2026-98734

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A recent flaw in the Linux kernel's Bluetooth handling can let a local user cause crashes or memory corruption by racing connection setup and teardown.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in hci_low_sent, hci_sched_iso and hci_sched_sco after RCU read lock is dropped; a freed hci_conn can be dereferenced from the TX workqueue while hci_abort_conn_sync removes it on the request workqueue.

Why it matters to the business

Local attackers with Bluetooth socket access can trigger kernel crashes or memory corruption on affected Linux systems; the issue is five days old with no known in-the-wild exploitation yet, but kernel stability and security are at risk until patched.

How an attack unfolds

An attacker opens an ISO or SCO Bluetooth connection, then races connection teardown (via hci_disconnect_sync or hci_abort_conn_sync) against the hci_tx_work scheduling path so that a freed connection object is accessed after synchronize_rcu completes.

How to fix it

Update the Linux kernel to a version containing the fix that holds hci_dev_lock across connection selection and transmission in the SCO and ISO schedulers; rebuild and reboot systems after applying the patch.

How to confirm the fix worked

Confirm the kernel source contains the mutex acquisition in __hci_sched_sco and the callers from ACL/LE paths; recompile with KASAN and exercise ISO/SCO connect/teardown workloads to verify absence of use-after-free reports.

Typical attack path

  1. Obtain local access or a user context able to create Bluetooth ISO/SCO sockets
  2. Establish an ISO or SCO connection via the Bluetooth stack
  3. Trigger concurrent connection abort/teardown while the TX worker is scheduling packets
  4. Trigger KASAN-detected slab-use-after-free in hci_low_sent during hci_tx_work

How to detect it

Review kernel logs for KASAN reports referencing hci_low_sent, hci_sched_iso, hci_tx_work and slab-use-after-free; correlate with Bluetooth connection establishment and teardown events in dmesg or audit logs.

What your security team should do

  • Prioritize kernel updates on any system exposing Bluetooth (especially ISO/SCO) within the next patch cycle
  • Monitor upstream stable branches and distribution security lists for the backported fix
  • Temporarily restrict unprivileged Bluetooth socket creation via LSM or seccomp where feasible until patched

The record

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Serialize SCO and ISO scheduling with teardown hci_low_sent() selects a connection under RCU but drops the read lock before calculating its quota and returning it to the scheduler. The connection is then used without lifetime protection by hci_sched_iso() and hci_sched_sco(). After the TX worker drops the RCU read lock, hci_abort_conn_sync() on hdev->req_workqueue can remove the connection from the hash, complete synchronize_rcu(), purge its queues and release it. The TX worker on hdev->workqueue can then access the freed connection in hci_quote_sent() or while dequeuing packets and updating conn->sent. KASAN reported: BUG: KASAN: slab-use-after-free in hci_low_sent+0x730/0x840 Workqueue: hci0 hci_tx_work Call Trace: hci_low_sent+0x730/0x840 hci_sched_iso+0x25e/0x4d0 hci_tx_work+0x239/0xcb0 Allocated by task 93: __hci_conn_add+0x16f/0x1b40 hci_bind_bis+0x782/0x17b0 hci_connect_bis+0xa0/0x510 iso_sock_connect+0x589/0x1050 Freed by task 88: kfree+0x131/0x3c0 device_release+0xc8/0x240 kobject_put+0x14d/0x280 hci_conn_del+0x55a/0xe80 hci_disconnect_sync+0x156/0x180 hci_abort_conn_sync+0x3e7/0x940 hci_cmd_sync_work+0x13c/0x290 Hold hci_dev_lock() across connection selection and transmission in both SCO and ISO scheduling, serializing them with connection teardown. This also prevents queuing completion timestamps after the connection queues have been purged. Extending RCU across transmission would be unsafe because the transmit path can sleep. Keep the ISO timeout check outside the mutex since hci_link_tx_to() takes it itself. The preceding channel fix already holds this mutex in the ACL and LE schedulers, which call the SCO scheduler between packets. Move the SCO body to __hci_sched_sco(), assert that its caller holds the mutex, and use it directly from these locked paths. Keep a locking hci_sched_sco() wrapper for the direct calls from hci_tx_work(). This avoids recursively acquiring the device mutex while preserving the scheduling order. Remove the obsolete claim that connection removal disables TX.

Affected packages

Ecosystem Package Introduced Fixed