{"id":"CVE-2026-98632","kind":"vulnerability","aliases":["CVE-2026-98632"],"related":[],"title":"Linux kernel: Bluetooth mesh cancel frees a transmission still queued","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel\n\nIn send_cancel(), pending mesh_tx objects are removed from the\nhdev->mesh_pending list and freed via mesh_send_complete().  However, if\na mesh transmission was already queued onto hdev->cmd_sync_work_list via\nmesh_next(), the queued entry retains a raw pointer to mesh_tx.\n\nWhen hci_cmd_sync_work later processes the entry, it attempts to execute\nmesh_send_sync and its destroy callback mesh_send_start_complete using\nthe already freed mesh_tx pointer, leading to a use-after-free.\n\nFix this by invoking hci_cmd_sync_dequeue() for mesh_send_sync on the\ntarget mesh_tx before completing it.  If the entry is found and dequeued,\nits destroy callback will complete and free the object; otherwise,\nmesh_send_complete() is called directly.\n\nAdditionally, ensure the transmission queue advances after cancellation\nor errors.  In mesh_send_start_complete(), call mesh_next() on error\nunless err is -ECANCELED, because hci_cmd_sync_dequeue() holds\nhdev->cmd_sync_work_lock and calling mesh_next() synchronously would\ndeadlock.  Instead, advance the queue in send_cancel() once the lock is\nreleased and if no transmission is in progress.","summary":"A use-after-free in the Linux kernel Bluetooth management code happens when a pending mesh transmission is cancelled while a queued entry still points at it. The sources do not state what an attacker gets beyond a memory-corruption condition.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bluetooth","linux-kernel","runtime","self-hosted"],"not_affected_if":["default-config"],"how_to_check":"- unknown","fix":"- Update the Linux kernel to a release that includes the upstream commit resolving this Bluetooth mgmt mesh_send_sync fix.","status":"open","published_at":"2026-10-18T16:17:16+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:21:04+00:00","updated_at":"2026-10-25T05:21:04+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-25T05:21:04Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit resolving this Bluetooth mgmt mesh_send_sync fix.","reach":"local","title":"Linux kernel: Bluetooth mesh cancel frees a transmission still queued","impact":"high","summary":"A use-after-free in the Linux kernel Bluetooth management code happens when a pending mesh transmission is cancelled while a queued entry still points at it. The sources do not state what an attacker gets beyond a memory-corruption condition.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","bluetooth","self-hosted"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; memory corruption in the kernel, possible code execution","analyst_note":"Check the NVD entry and the upstream kernel commit for affected version ranges, severity, and whether a Bluetooth mesh mgmt interface is reachable by unprivileged users.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Systems running a Linux kernel with Bluetooth mesh management support built in, where the mgmt mesh send and cancel path is used. The sources do not say which kernel versions are affected or whether the path is reachable without local access.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000618,"input_tokens":3716,"output_tokens":493,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-98632':13A,16A 'addit':217C 'advanc':222C,260C 'alreadi':115C,162C 'attack':60B 'attempt':146C 'beyond':62B 'bluetooth':3A,17B,34B,78C 'call':215C,232C,253C 'callback':155C,203C 'cancel':5A,44B,87C,90C,224C,265C 'cmd':119C,138C,179C,243C,248C 'code':36B 'complet':108C,159C,192C,205C,213C,231C 'condit':67B 'corrupt':66B 'cve':11A,14A 'deadlock':258C 'dequeu':80C,181C,200C,245C 'destroy':154C,202C 'direct':216C 'ecancel':240C 'ensur':218C 'entri':48B,85C,128C,144C,196C 'err':238C 'error':226C,236C 'execut':148C 'fix':174C 'follow':73C 'found':198C 'free':6A,29B,173C,207C 'freed':104C,163C 'get':61B 'happen':37B 'hci':137C,178C,242C 'hdev':99C,118C,247C 'hold':246C 'host':24B 'howev':109C 'instead':259C 'invok':177C 'kernel':2A,20B,33B,71C 'later':141C 'lead':167C 'linux':1A,19B,32B,70C 'linux-kernel':18B 'list':102C,122C 'lock':251C,268C 'manag':35B 'memori':65B 'memory-corrupt':64B 'mesh':4A,41B,82C,92C,100C,106C,112C,124C,134C,149C,156C,164C,183C,189C,211C,228C,233C,254C 'mgmt':79C 'next':125C,234C,255C 'object':94C,209C 'onto':117C 'otherwis':210C 'pend':40B,81C,91C,101C 'point':50B 'pointer':132C,166C 'process':142C 'progress':277C 'queu':10A,47B,116C,127C 'queue':221C,262C 'raw':131C 'releas':270C 'remov':96C 'resolv':77C 'retain':129C 'runtim':21B 'self':23B 'self-host':22B 'send':83C,89C,107C,150C,157C,184C,212C,229C,264C 'sourc':54B 'start':158C,230C 'state':57B 'still':9A,49B 'sync':84C,120C,139C,151C,180C,185C,244C,249C 'synchron':256C 'target':188C 'transmiss':8A,42B,113C,220C,274C 'tx':93C,135C,165C,190C 'unless':237C 'use':27B,160C,171C 'use-after-fre':26B,170C 'via':105C,123C 'vulner':74C 'work':121C,140C,250C 'would':257C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with Bluetooth mesh management support built in, where the mgmt mesh send and cancel path is used. The sources do not say which kernel versions are affected or whether the path is reachable without local access.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:16+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98632","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98632","severity":null,"published_at":"2026-10-18T16:17:16+00:00","modified_at":"2026-10-19T10:19:27+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}