Bluetooth: hci_conn: Lock parent access during enhanced SCO setup

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-98736
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-10-18 16:17:27 UTC
Updated2026-10-30 13:21:22 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: Lock parent access during enhanced SCO setup Bluetooth: hci_conn: Lock parent access during enhanced SCO setup hci_enhanced_setup_sync() runs on the request workqueue without the hci_dev_lock held by its caller when setup was queued. Its CVSD capability check and find_next_esco_param() dereference conn->parent while the receive workqueue can unlink and release that parent. The following interleaving can cause a use-after-free: hci_enhanced_setup_sync() hci_disconn_complete_evt() load conn->parent hci_dev_lock() hci_conn_del(ACL parent) unlink SCO child drop link's parent reference clear child->parent release ACL parent bt_link_release() kfree(parent) hci_dev_unlock() read parent->features[0][3] The reference held for the queued SCO child does not keep its ACL parent alive after unlinking. Commit 42de40abe25d ("Bluetooth: hci_conn: fix the SCO setup context lifetime") protects the child stored in the queued context, but leaves these parent accesses unprotected. With a 40 ms diagnostic delay after loading conn->parent, an instrumented kernel based on fd179f8a05be, which already contains 42de40abe25d, BUG: KASAN: slab-use-after-free in hci_enhanced_setup_sync+0xda5/0xdf0 Read of size 1 at addr ffff888102204047 by task kworker/u17:0/93 Call Trace: hci_enhanced_setup_sync+0xda5/0xdf0 hci_cmd_sync_work+0x13c/0x290 process_one_work+0x6b4/0x10e0 Allocated by task 92: __hci_conn_add+0x304/0x1df0 hci_connect_acl+0x349/0x3e0 hci_connect_sco+0x3b/0x9a0 sco_sock_connect+0x475/0xca0 Freed by task 94: kfree+0x121/0x3c0 bt_link_release+0x79/0xa0 device_release+0xc8/0x240 kobject_put+0x14d/0x280 hci_conn_del+0x524/0xe30 hci_disconn_complete_evt+0x403/0x8c0 hci_event_packet+0x71b/0xb20 hci_rx_work+0x293/0x730 The accessed address is 71 bytes into the freed ACL parent, at its features[0][3] byte; the queued SCO child is a different object. The diagnostic preserves the loaded parent across the delay, matching the unmodified compiled capability check, and does not change the parent references or teardown path. Hold hci_dev_lock() across the codec switch, including every call to find_next_esco_param(), and release it on all selection errors. Keep configure_datapath_sync() outside the critical section because it waits for HCI events. Preserve parameter selection and existing return values.

Risk And Classification

EPSS: 0.001680000 probability, percentile 0.060530000 (date 2026-10-30)

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected e07a06b4eb417f5271d33ce2240e93c62d98b7b4 48bf3b94c7331e11eaa6c89adc054a7bc7c0382e git Not specified
CNA Linux Linux affected e07a06b4eb417f5271d33ce2240e93c62d98b7b4 70b55855eecb428d446344d827bda8725ce8b312 git Not specified
CNA Linux Linux affected e07a06b4eb417f5271d33ce2240e93c62d98b7b4 1239ef0fa809b5952fca679db3faa3e1c00e1dac git Not specified
CNA Linux Linux affected e07a06b4eb417f5271d33ce2240e93c62d98b7b4 cabd58d9bb66d49d481f762ce986173db397435d git Not specified
CNA Linux Linux affected e07a06b4eb417f5271d33ce2240e93c62d98b7b4 93a737e4e042f59673cd580d35214f278d7b757d git Not specified
CNA Linux Linux affected e07a06b4eb417f5271d33ce2240e93c62d98b7b4 024e05f73a4c1263d031614bc36700ec135eecb4 git Not specified
CNA Linux Linux affected 6.1 Not specified
CNA Linux Linux unaffected 6.1 semver Not specified
CNA Linux Linux unaffected 6.1.191 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.160 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.113 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.56 6.18.* semver Not specified
CNA Linux Linux unaffected 7.2.10 7.2.* semver Not specified
CNA Linux Linux unaffected 7.3 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/48bf3b94c7331e11eaa6c89adc054a7bc7c0382e 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/93a737e4e042f59673cd580d35214f278d7b757d 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/cabd58d9bb66d49d481f762ce986173db397435d 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/1239ef0fa809b5952fca679db3faa3e1c00e1dac 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/70b55855eecb428d446344d827bda8725ce8b312 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/024e05f73a4c1263d031614bc36700ec135eecb4 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report