CVE-2026-98735
Received Received - Intake

Bluetooth Use-After-Free in Linux Kernel

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Serialize ACL scheduling with channel deletion hci_chan_sent() selects a channel under RCU but drops the read lock before accessing chan->conn and returning the channel. The ACL and LE schedulers then use its packet queue and update its transmit counters without any protection against channel deletion. After TX selects a channel and releases RCU, a disconnect command timeout on the separate request workqueue can run hci_conn_failed() and l2cap_conn_del(). hci_chan_del() can then unlink the channel, complete synchronize_rcu(), purge its queue and free it before TX resumes. This causes use-after-free both in hci_chan_sent() and in its callers. KASAN reported: BUG: KASAN: slab-use-after-free in hci_chan_sent+0x892/0x9b0 Workqueue: hci0 hci_tx_work Call Trace: hci_chan_sent+0x892/0x9b0 hci_tx_work+0x5e6/0xb70 Allocated by task 91: hci_chan_create+0xe3/0x350 l2cap_conn_add.part.0+0x12/0xa30 l2cap_chan_connect+0x110d/0x1b60 l2cap_sock_connect+0x310/0x530 Freed by task 99: hci_chan_del+0x11f/0x170 l2cap_conn_del+0x4f1/0x800 l2cap_connect_cfm+0x88c/0xd30 hci_conn_failed+0x150/0x250 hci_abort_conn_sync+0x3e3/0x800 hci_cmd_sync_run+0x7e/0xc0 hci_abort_conn+0x105/0x1f0 disconnect_sync+0x157/0x290 hci_cmd_sync_work+0x13c/0x290 Hold the existing device mutex across channel selection and transmission in both schedulers to serialize them with channel teardown. Keep timeout handling outside the critical sections because hci_link_tx_to() acquires the same mutex. This also permits the transmit path to sleep, unlike extending the RCU read-side critical section across packet submission.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98735
EUVD
EUVD-2026-103820

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
Linux Linux 3eff45eaf81780dad25c167bbaafa7d25ae407da
Linux Linux 3eff45eaf81780dad25c167bbaafa7d25ae407da
Linux Linux 3eff45eaf81780dad25c167bbaafa7d25ae407da
Linux Linux 3eff45eaf81780dad25c167bbaafa7d25ae407da
Linux Linux 3.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's Bluetooth subsystem. It occurs when the hci_chan_sent() function selects a channel under RCU lock but drops it before accessing channel data. A disconnect timeout can then delete the channel while the function is still using it, causing memory corruption and crashes.

Detection Guidance

This vulnerability is specific to the Linux kernel's Bluetooth subsystem and requires kernel-level detection. Monitor kernel logs for use-after-free errors in Bluetooth components using dmesg or journalctl. Check for crashes in hci_tx_work or hci_chan_sent functions. No direct network commands detect this; focus on system logs and kernel traces.

Impact Analysis

This vulnerability can cause system crashes, kernel memory corruption, or privilege escalation if exploited. It specifically affects Bluetooth operations, potentially leading to denial of service or unauthorized access via Bluetooth interfaces.

Mitigation Strategies

Apply the latest Linux kernel patches addressing this issue. Disable Bluetooth if not required. Restrict Bluetooth usage to trusted devices. Monitor for unusual Bluetooth activity or crashes. Update to a patched kernel version as soon as possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98735. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart