CVE-2026-98632

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel

In send_cancel(), pending mesh_tx objects are removed from the

hdev->mesh_pending list and freed via mesh_send_complete(). However, if

a mesh transmission was already queued onto hdev->cmd_sync_work_list via

mesh_next(), the queued entry retains a raw pointer to mesh_tx.

When hci_cmd_sync_work later processes the entry, it attempts to execute

mesh_send_sync and its destroy callback mesh_send_start_complete using

the already freed mesh_tx pointer, leading to a use-after-free.

Fix this by invoking hci_cmd_sync_dequeue() for mesh_send_sync on the

target mesh_tx before completing it. If the entry is found and dequeued,

its destroy callback will complete and free the object; otherwise,

mesh_send_complete() is called directly.

Additionally, ensure the transmission queue advances after cancellation

or errors. In mesh_send_start_complete(), call mesh_nex

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References