CVE-2026-98733

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_core: Serialize fragmented ISO packet queueing

The fragmented path in hci_queue_iso() calls __skb_queue_tail() without

holding conn->data_q.lock. The socket lock serializes senders, but the

transmit worker can concurrently remove packets from this queue using

skb_dequeue().

After an insertion saves the old tail pointer, hci_sched_iso() can dequeue

that packet and pass it to the driver. The driver can free the packet

before the insertion resumes and writes to the old tail's next pointer,

causing a use-after-free. Concurrent updates can also corrupt the queue.

KASAN reported:

BUG: KASAN: slab-use-after-free in hci_send_iso+0xc7d/0xe10

Call Trace:

hci_send_iso+0xc7d/0xe10

iso_sock_sendmsg+0x710/0x900

__sys_sendto+0x34a/0x3a0

Allocated by task 86:

__alloc_skb+0xdd/0x820

alloc_skb_with_frags+0x7e/0x770

sock_alloc_send_pskb+0x67a/0x820

bt_skb_sendmsg.constprop.0+0xc0/0x6c0

i

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References