CVE-2026-98736

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_conn: Lock parent access during enhanced SCO setup

Bluetooth: hci_conn: Lock parent access during enhanced SCO setup

hci_enhanced_setup_sync() runs on the request workqueue without the

hci_dev_lock held by its caller when setup was queued. Its CVSD

capability check and find_next_esco_param() dereference conn->parent

while the receive workqueue can unlink and release that parent.

The following interleaving can cause a use-after-free:

hci_enhanced_setup_sync() hci_disconn_complete_evt()

load conn->parent

hci_dev_lock()

hci_conn_del(ACL parent)

unlink SCO child

drop link's parent reference

clear child->parent

release ACL parent

bt_link_release()

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References