CVE-2026-98737

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_sync: Fix inquiry cache use-after-free

The sync command worker holds hdev->req_lock, but inquiry-cache updates

and flushes use hdev->lock. Both hci_acl_create_conn_sync() and

hci_stop_discovery_sync() look up entries and read their fields without

taking hdev->lock.

After either lookup returns, a concurrent HCIINQUIRY ioctl can acquire

hdev->lock and flush the cache, freeing the entry. The worker then reads

the freed entry while preparing a create-connection or remote-name-cancel

command. The list traversal also races with cache updates and removal.

KASAN reported these accesses:

BUG: KASAN: slab-use-after-free in hci_acl_create_conn_sync+0x5f1/0x650

Workqueue: hci0 hci_cmd_sync_work

Call Trace:

hci_acl_create_conn_sync+0x5f1/0x650

hci_cmd_sync_work+0x13c/0x290

Allocated by task 90:

hci_inquiry_cache_update+0x3e6/0x7d0

hci_inquiry_result_evt+0x3cb/0x560

Freed by task 93:

hc

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References