{"id":"CVE-2026-98733","kind":"vulnerability","aliases":["CVE-2026-98733"],"related":[],"title":"Linux kernel: Bluetooth ISO fragment queueing race causes use-after-free","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_core: Serialize fragmented ISO packet queueing\n\nThe fragmented path in hci_queue_iso() calls __skb_queue_tail() without\nholding conn->data_q.lock. The socket lock serializes senders, but the\ntransmit worker can concurrently remove packets from this queue using\nskb_dequeue().\n\nAfter an insertion saves the old tail pointer, hci_sched_iso() can dequeue\nthat packet and pass it to the driver. The driver can free the packet\nbefore the insertion resumes and writes to the old tail's next pointer,\ncausing a use-after-free. Concurrent updates can also corrupt the queue.\n\nKASAN reported:\n\n  BUG: KASAN: slab-use-after-free in hci_send_iso+0xc7d/0xe10\n  Call Trace:\n   hci_send_iso+0xc7d/0xe10\n   iso_sock_sendmsg+0x710/0x900\n   __sys_sendto+0x34a/0x3a0\n\n  Allocated by task 86:\n   __alloc_skb+0xdd/0x820\n   alloc_skb_with_frags+0x7e/0x770\n   sock_alloc_send_pskb+0x67a/0x820\n   bt_skb_sendmsg.constprop.0+0xc0/0x6c0\n   iso_sock_sendmsg+0x44e/0x900\n\n  Freed by task 90:\n   kmem_cache_free+0xcb/0x3d0\n   vhci_read+0x33f/0x4d0\n   vfs_read+0x177/0xa20\n\nHold the queue lock across the entire fragment batch, as hci_queue_acl()\ndoes, to serialize insertion against dequeue while preserving fragment\nordering.","summary":"In the Linux kernel's Bluetooth stack, fragmented ISO packets were queued without holding the queue lock, so the transmit worker could dequeue and free a packet while insertion still wrote to it. The sources describe a use-after-free that a local process could trigger with concurrent sends, with possible queue corruption.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bluetooth","infrastructure","linux-kernel","self-hosted"],"not_affected_if":["no-bluetooth-iso"],"how_to_check":"- unknown","fix":"- Install a Linux kernel release that includes the upstream commit 'Bluetooth: hci_core: Serialize fragmented ISO packet queueing'\n- unknown","status":"open","published_at":"2026-10-18T16:17:26+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:17:12+00:00","updated_at":"2026-10-25T05:17:12+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T05:17:12Z","model":"claude-haiku-5-5","output":{"fix":"- Install a Linux kernel release that includes the upstream commit 'Bluetooth: hci_core: Serialize fragmented ISO packet queueing'\n- unknown","reach":"local","title":"Linux kernel: Bluetooth ISO fragment queueing race causes use-after-free","impact":"high","summary":"In the Linux kernel's Bluetooth stack, fragmented ISO packets were queued without holding the queue lock, so the transmit worker could dequeue and free a packet while insertion still wrote to it. The sources describe a use-after-free that a local process could trigger with concurrent sends, with possible queue corruption.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","bluetooth","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Use-after-free in kernel memory could lead to code execution in kernel","analyst_note":"Find the affected kernel version range and the fixed stable releases in the NVD entry or the kernel git commit for the ISO queueing fix.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-bluetooth-iso"],"who_is_affected":"Systems running a Linux kernel with Bluetooth ISO support (LE Audio and similar isochronous links) built before this fix. The sources do not say which kernel versions are affected or whether hosts without Bluetooth hardware or with the module unloaded are exposed, so unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000655,"input_tokens":3817,"output_tokens":547,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':199C,206C,211C,215C,223C,229C,235C,239C,244C,253C,257C,261C '-2026':14A,17A '-98733':15A,18A '0':238C '86':220C '90':249C 'acl':275C 'across':267C 'alloc':217C,221C,225C,232C 'also':182C 'batch':271C 'bluetooth':3A,19B,32B,91C 'bt_skb_sendmsg.constprop':237C 'bug':188C 'cach':251C 'call':106C,201C 'caus':8A,173C 'concurr':75B,124C,179C 'conn':112C 'core':93C 'corrupt':80B,183C 'could':48B,72B 'cve':13A,16A 'data_q.lock':113C 'dequeu':49B,132C,145C,281C 'describ':62B 'driver':153C,155C 'entir':269C 'follow':86C 'frag':228C 'fragment':5A,34B,95C,100C,270C,284C 'free':12A,51B,67B,157C,178C,194C,252C 'freed':246C 'hci':92C,103C,141C,196C,203C,273C 'hold':40B,111C,263C 'host':26B 'infrastructur':20B 'insert':55B,135C,162C,279C 'iso':4A,35B,96C,105C,143C,198C,205C,208C,241C 'kasan':186C,189C 'kernel':2A,23B,30B,84C 'kmem':250C 'linux':1A,22B,29B,83C 'linux-kernel':21B 'local':70B 'lock':43B,116C,266C 'next':171C 'old':138C,168C 'order':285C 'packet':36B,53B,97C,126C,147C,159C 'pass':149C 'path':101C 'pointer':140C,172C 'possibl':78B 'preserv':283C 'process':71B 'pskb':234C 'queu':38B 'queue':6A,42B,79B,98C,104C,108C,129C,185C,265C,274C 'race':7A 'read':256C,260C 'remov':125C 'report':187C 'resolv':90C 'resum':163C 'save':136C 'sched':142C 'self':25B 'self-host':24B 'send':76B,197C,204C,233C 'sender':118C 'sendmsg':210C,243C 'sendto':214C 'serial':94C,117C,278C 'skb':107C,131C,222C,226C 'slab':191C 'slab-use-after-fre':190C 'sock':209C,231C,242C 'socket':115C 'sourc':61B 'stack':33B 'still':56B 'sys':213C 'tail':109C,139C,169C 'task':219C,248C 'trace':202C 'transmit':46B,121C 'trigger':73B 'updat':180C 'use':10A,65B,130C,176C,192C 'use-after-fre':9A,64B,175C 'vfs':259C 'vhci':255C 'vulner':87C 'without':39B,110C 'worker':47B,122C 'write':165C 'wrote':57B 'x177/0xa20':262C 'x33f/0x4d0':258C 'x34a/0x3a0':216C 'x44e/0x900':245C 'x67a/0x820':236C 'x710/0x900':212C 'x7e/0x770':230C 'xc0/0x6c0':240C 'xc7d/0xe10':200C,207C 'xcb/0x3d0':254C 'xdd/0x820':224C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with Bluetooth ISO support (LE Audio and similar isochronous links) built before this fix. The sources do not say which kernel versions are affected or whether hosts without Bluetooth hardware or with the module unloaded are exposed, so unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:26+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98733","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98733","severity":null,"published_at":"2026-10-18T16:17:26+00:00","modified_at":"2026-10-21T13:21:40+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}