CVE-2026-98735

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_core: Serialize ACL scheduling with channel deletion

hci_chan_sent() selects a channel under RCU but drops the read lock before

accessing chan->conn and returning the channel. The ACL and LE schedulers

then use its packet queue and update its transmit counters without any

protection against channel deletion.

After TX selects a channel and releases RCU, a disconnect command timeout

on the separate request workqueue can run hci_conn_failed() and

l2cap_conn_del(). hci_chan_del() can then unlink the channel, complete

synchronize_rcu(), purge its queue and free it before TX resumes. This

causes use-after-free both in hci_chan_sent() and in its callers.

KASAN reported:

BUG: KASAN: slab-use-after-free in hci_chan_sent+0x892/0x9b0

Workqueue: hci0 hci_tx_work

Call Trace:

hci_chan_sent+0x892/0x9b0

hci_tx_work+0x5e6/0xb70

Allocated by task 91:

hci_chan_create+0xe3/0x350

l2cap_conn_add.part.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References