CVE-2026-98632
Received Received - Intake

Bluetooth Use-After-Free in Linux Kernel

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel In send_cancel(), pending mesh_tx objects are removed from the hdev->mesh_pending list and freed via mesh_send_complete(). However, if a mesh transmission was already queued onto hdev->cmd_sync_work_list via mesh_next(), the queued entry retains a raw pointer to mesh_tx. When hci_cmd_sync_work later processes the entry, it attempts to execute mesh_send_sync and its destroy callback mesh_send_start_complete using the already freed mesh_tx pointer, leading to a use-after-free. Fix this by invoking hci_cmd_sync_dequeue() for mesh_send_sync on the target mesh_tx before completing it. If the entry is found and dequeued, its destroy callback will complete and free the object; otherwise, mesh_send_complete() is called directly. Additionally, ensure the transmission queue advances after cancellation or errors. In mesh_send_start_complete(), call mesh_next() on error unless err is -ECANCELED, because hci_cmd_sync_dequeue() holds hdev->cmd_sync_work_lock and calling mesh_next() synchronously would deadlock. Instead, advance the queue in send_cancel() once the lock is released and if no transmission is in progress.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98632
EUVD
EUVD-2026-103546

Affected Vendors & Products

Showing 7 associated CPEs
Vendor Product Version / Range
Linux Linux b338d91703fae6f6afd67f3f75caa3b8f36ddef3
Linux Linux b338d91703fae6f6afd67f3f75caa3b8f36ddef3
Linux Linux b338d91703fae6f6afd67f3f75caa3b8f36ddef3
Linux Linux b338d91703fae6f6afd67f3f75caa3b8f36ddef3
Linux Linux b338d91703fae6f6afd67f3f75caa3b8f36ddef3
Linux Linux b338d91703fae6f6afd67f3f75caa3b8f36ddef3
Linux Linux 6.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's Bluetooth management subsystem. It occurs when mesh_send_sync entries are not properly dequeued during cancellation, leading to attempts to use freed memory. The issue arises because a queued entry retains a pointer to an already freed mesh_tx object, which is later accessed by hci_cmd_sync_work.

Impact Analysis

This vulnerability could allow an attacker to cause a denial-of-service condition or potentially execute arbitrary code with kernel privileges. It may lead to system crashes, data corruption, or unauthorized access depending on the attacker's capabilities and system configuration.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve the Bluetooth mesh use-after-free vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98632. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart