CVE-2026-98738
Received Received - Intake

Bluetooth Use-After-Free in Linux Kernel

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Serialize SMP remote OOB data access build_pairing_cmd() looks up remote OOB data and copies its contents without holding hdev->lock, which serializes the list's writers. After SMP finds an entry, a concurrent management Remove Remote OOB Data command can unlink and free it before SMP reads its present flag or copies its random and confirmation values. Removal can also invalidate an entry while the lookup is still traversing the list. KASAN reported: BUG: KASAN: slab-use-after-free in build_pairing_cmd+0x948/0x9b0 Call Trace: build_pairing_cmd+0x948/0x9b0 smp_recv_cb+0x459f/0x8110 l2cap_recv_frame+0xf14/0x9190 l2cap_recv_acldata+0xa64/0xd40 hci_rx_work+0x4ca/0x730 Allocated by task 87: hci_add_remote_oob_data+0x11d/0x530 add_remote_oob_data+0x282/0x400 hci_sock_sendmsg+0x1033/0x1ea0 Freed by task 93: hci_remote_oob_data_clear+0x108/0x1c0 remove_remote_oob_data+0x198/0x220 hci_sock_sendmsg+0x1033/0x1ea0 Taking hdev->lock in build_pairing_cmd() would recurse for callers that already hold it and invert the device-to-L2CAP lock order on the receive path. Add a per-device remote_oob_lock instead, held across the SMP lookup and copies and by the add, remove and clear helpers. Cover initialization and in-place updates as well, so SMP cannot read partially initialized or updated OOB values. Release the mutex on allocation failure, preserving the existing error return. The new critical sections acquire no device, connection or channel locks. Writers retain their existing hdev->lock protection, which continues to serialize the other readers without changing their locking or behavior.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98738
EUVD
EUVD-2026-103823

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
Linux Linux 02b05bd8b0a632e9a26795bced8f19ca6a5f7079
Linux Linux 02b05bd8b0a632e9a26795bced8f19ca6a5f7079
Linux Linux 02b05bd8b0a632e9a26795bced8f19ca6a5f7079
Linux Linux 02b05bd8b0a632e9a26795bced8f19ca6a5f7079
Linux Linux 3.19

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a race condition in Bluetooth's Secure Simple Pairing (SMP) process. The function build_pairing_cmd() accesses remote Out-of-Band (OOB) data without proper locking, allowing a concurrent operation to remove and free the data before SMP can read it. This leads to a use-after-free error, as reported by KASAN, causing crashes or potential code execution.

Detection Guidance

This vulnerability is specific to the Linux kernel's Bluetooth subsystem and may not have direct network detection commands. However, you can check for kernel logs indicating slab-use-after-free errors related to Bluetooth operations using: dmesg | grep -i 'KASAN.*slab-use-after-free.*build_pairing_cmd' or journalctl -k | grep -i 'KASAN.*slab-use-after-free.*build_pairing_cmd'.

Impact Analysis

This vulnerability could allow an attacker within Bluetooth range to cause a denial-of-service (DoS) condition by crashing the system. In rare cases, it might lead to arbitrary code execution, though exploitation is complex and requires specific timing conditions.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this vulnerability. The patch introduces a per-device remote_oob_lock to prevent race conditions in Bluetooth OOB data handling.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98738. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart