CVE-2026-98733
Received Received - Intake

Bluetooth Use-After-Free in Linux Kernel

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Serialize fragmented ISO packet queueing The fragmented path in hci_queue_iso() calls __skb_queue_tail() without holding conn->data_q.lock. The socket lock serializes senders, but the transmit worker can concurrently remove packets from this queue using skb_dequeue(). After an insertion saves the old tail pointer, hci_sched_iso() can dequeue that packet and pass it to the driver. The driver can free the packet before the insertion resumes and writes to the old tail's next pointer, causing a use-after-free. Concurrent updates can also corrupt the queue. KASAN reported: BUG: KASAN: slab-use-after-free in hci_send_iso+0xc7d/0xe10 Call Trace: hci_send_iso+0xc7d/0xe10 iso_sock_sendmsg+0x710/0x900 __sys_sendto+0x34a/0x3a0 Allocated by task 86: __alloc_skb+0xdd/0x820 alloc_skb_with_frags+0x7e/0x770 sock_alloc_send_pskb+0x67a/0x820 bt_skb_sendmsg.constprop.0+0xc0/0x6c0 iso_sock_sendmsg+0x44e/0x900 Freed by task 90: kmem_cache_free+0xcb/0x3d0 vhci_read+0x33f/0x4d0 vfs_read+0x177/0xa20 Hold the queue lock across the entire fragment batch, as hci_queue_acl() does, to serialize insertion against dequeue while preserving fragment ordering.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98733
EUVD
EUVD-2026-103818

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
Linux Linux 26afbd826ee326e63a334c37fd45e82e50a615ec
Linux Linux 26afbd826ee326e63a334c37fd45e82e50a615ec
Linux Linux 26afbd826ee326e63a334c37fd45e82e50a615ec
Linux Linux 26afbd826ee326e63a334c37fd45e82e50a615ec
Linux Linux 6.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a use-after-free issue in Bluetooth ISO packet handling. The fragmented ISO packet queueing in hci_core lacks proper locking, allowing concurrent operations to corrupt the queue or free memory prematurely. This can lead to memory corruption or crashes when packets are accessed after being freed.

Detection Guidance

This vulnerability is specific to the Linux kernel's Bluetooth subsystem and may not have direct detection commands. Monitor kernel logs for KASAN reports or slab-use-after-free errors related to hci_send_iso. Check for Bluetooth-related crashes or unexpected behavior in ISO packet handling.

Impact Analysis

This vulnerability could cause system instability, crashes, or potential privilege escalation if exploited. Users running affected Linux kernel versions with Bluetooth functionality may experience unexpected behavior or security breaches due to memory corruption.

Mitigation Strategies

Apply the latest Linux kernel security patches that address this issue. If patches are unavailable, consider disabling Bluetooth ISO functionality or restricting Bluetooth usage until an update is applied. Monitor vendor advisories for kernel updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98733. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart