CVE-2026-98734

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_core: Serialize SCO and ISO scheduling with teardown

hci_low_sent() selects a connection under RCU but drops the read lock

before calculating its quota and returning it to the scheduler. The

connection is then used without lifetime protection by hci_sched_iso()

and hci_sched_sco().

After the TX worker drops the RCU read lock, hci_abort_conn_sync() on

hdev->req_workqueue can remove the connection from the hash, complete

synchronize_rcu(), purge its queues and release it. The TX worker on

hdev->workqueue can then access the freed connection in hci_quote_sent()

or while dequeuing packets and updating conn->sent.

KASAN reported:

BUG: KASAN: slab-use-after-free in hci_low_sent+0x730/0x840

Workqueue: hci0 hci_tx_work

Call Trace:

hci_low_sent+0x730/0x840

hci_sched_iso+0x25e/0x4d0

hci_tx_work+0x239/0xcb0

Allocated by task 93:

__hci_conn_add+0x16f/0x1b40

hci_bind_bis+0x782/0x17b0

h

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References