{"id":"CVE-2026-98735","kind":"vulnerability","aliases":["CVE-2026-98735"],"related":[],"title":"Linux kernel: Bluetooth channel teardown race causes use-after-free","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_core: Serialize ACL scheduling with channel deletion\n\nhci_chan_sent() selects a channel under RCU but drops the read lock before\naccessing chan->conn and returning the channel. The ACL and LE schedulers\nthen use its packet queue and update its transmit counters without any\nprotection against channel deletion.\n\nAfter TX selects a channel and releases RCU, a disconnect command timeout\non the separate request workqueue can run hci_conn_failed() and\nl2cap_conn_del(). hci_chan_del() can then unlink the channel, complete\nsynchronize_rcu(), purge its queue and free it before TX resumes. This\ncauses use-after-free both in hci_chan_sent() and in its callers.\n\nKASAN reported:\n\n  BUG: KASAN: slab-use-after-free in hci_chan_sent+0x892/0x9b0\n  Workqueue: hci0 hci_tx_work\n  Call Trace:\n   hci_chan_sent+0x892/0x9b0\n   hci_tx_work+0x5e6/0xb70\n  Allocated by task 91:\n   hci_chan_create+0xe3/0x350\n   l2cap_conn_add.part.0+0x12/0xa30\n   l2cap_chan_connect+0x110d/0x1b60\n   l2cap_sock_connect+0x310/0x530\n  Freed by task 99:\n   hci_chan_del+0x11f/0x170\n   l2cap_conn_del+0x4f1/0x800\n   l2cap_connect_cfm+0x88c/0xd30\n   hci_conn_failed+0x150/0x250\n   hci_abort_conn_sync+0x3e3/0x800\n   hci_cmd_sync_run+0x7e/0xc0\n   hci_abort_conn+0x105/0x1f0\n   disconnect_sync+0x157/0x290\n   hci_cmd_sync_work+0x13c/0x290\n\nHold the existing device mutex across channel selection and transmission\nin both schedulers to serialize them with channel teardown. Keep timeout\nhandling outside the critical sections because hci_link_tx_to() acquires\nthe same mutex. This also permits the transmit path to sleep, unlike\nextending the RCU read-side critical section across packet submission.","summary":"The Linux kernel Bluetooth stack can use a freed ACL channel when a disconnect timeout runs while transmission selects that channel. An attacker able to trigger connection teardown may be able to corrupt kernel memory, and the sources do not state a code execution outcome.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bluetooth","kernel","linux","runtime","self-hosted"],"not_affected_if":["default-config"],"how_to_check":"- Run `uname -r` and compare against the kernel version that contains the upstream fix for CVE-2026-98735 (unknown from these sources)\n- Check whether the Bluetooth stack is loaded with `lsmod | grep bluetooth`","fix":"- Install a Linux kernel build that includes the upstream commit 'Bluetooth: hci_core: Serialize ACL scheduling with channel deletion' (fixed version unknown from these sources)\n- Reboot into the patched kernel","status":"open","published_at":"2026-10-18T16:17:27+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:17:10+00:00","updated_at":"2026-10-25T05:17:10+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T05:17:10Z","model":"claude-haiku-5-5","output":{"fix":"- Install a Linux kernel build that includes the upstream commit 'Bluetooth: hci_core: Serialize ACL scheduling with channel deletion' (fixed version unknown from these sources)\n- Reboot into the patched kernel","reach":"local","title":"Linux kernel: Bluetooth channel teardown race causes use-after-free","impact":"high","summary":"The Linux kernel Bluetooth stack can use a freed ACL channel when a disconnect timeout runs while transmission selects that channel. An attacker able to trigger connection teardown may be able to corrupt kernel memory, and the sources do not state a code execution outcome.","category":"runtime","nicknames":[],"who_cares":["linux","kernel","bluetooth","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"kernel memory corruption from a use-after-free in Bluetooth","analyst_note":"Confirm the fixed kernel version and whether a remote Bluetooth trigger exists; check the NVD entry and the upstream kernel commit.","how_to_check":"- Run `uname -r` and compare against the kernel version that contains the upstream fix for CVE-2026-98735 (unknown from these sources)\n- Check whether the Bluetooth stack is loaded with `lsmod | grep bluetooth`","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Systems running a Linux kernel with the Bluetooth HCI core and L2CAP stack enabled, where ACL connections are created and torn down. Machines without Bluetooth hardware or with the Bluetooth module blacklisted are unlikely to be exposed. The sources do not say which kernel versions are affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000717,"input_tokens":3998,"output_tokens":635,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':205C,217C,222C,231C,235C,240C,245C,254C,259C,264C,269C,275C,281C,286C,290C,296C '-2026':13A,16A '-98735':14A,17A '0':234C '91':227C '99':250C 'abl':48B,55B 'abort':272C,284C 'access':103C 'acl':34B,84C,111C 'acquir':329C 'across':303C,350C 'alloc':224C 'also':334C 'attack':47B 'bluetooth':3A,18B,28B,80C 'bug':194C 'call':212C 'caller':191C 'caus':7A,178C 'cfm':263C 'chan':90C,104C,158C,186C,203C,215C,229C,238C,252C 'channel':4A,35B,45B,87C,94C,109C,129C,135C,164C,304C,315C 'cmd':278C,293C 'code':67B 'command':141C 'complet':165C 'conn':105C,151C,155C,257C,267C,273C,285C 'connect':51B,239C,244C,262C 'core':82C 'corrupt':57B 'counter':124C 'creat':230C 'critic':322C,348C 'cve':12A,15A 'del':156C,159C,253C,258C 'delet':88C,130C 'devic':301C 'disconnect':38B,140C,288C 'drop':98C 'execut':68B 'exist':300C 'extend':342C 'fail':152C,268C 'follow':75C 'free':11A,172C,182C,200C 'freed':33B,247C 'handl':319C 'hci':81C,89C,150C,157C,185C,202C,209C,214C,219C,228C,251C,266C,271C,277C,283C,292C,325C 'hci0':208C 'hold':298C 'host':24B 'kasan':192C,195C 'keep':317C 'kernel':2A,19B,27B,58B,73C 'l2cap':154C,237C,242C,256C,261C 'l2cap_conn_add.part':233C 'le':113C 'link':326C 'linux':1A,20B,26B,72C 'lock':101C 'may':53B 'memori':59B 'mutex':302C,332C 'outcom':69B 'outsid':320C 'packet':118C,351C 'path':338C 'permit':335C 'protect':127C 'purg':168C 'queue':119C,170C 'race':6A 'rcu':96C,138C,167C,344C 'read':100C,346C 'read-sid':345C 'releas':137C 'report':193C 'request':146C 'resolv':79C 'resum':176C 'return':107C 'run':40B,149C,280C 'runtim':21B 'schedul':85C,114C,310C 'section':323C,349C 'select':43B,92C,133C,305C 'self':23B 'self-host':22B 'sent':91C,187C,204C,216C 'separ':145C 'serial':83C,312C 'side':347C 'slab':197C 'slab-use-after-fre':196C 'sleep':340C 'sock':243C 'sourc':62B 'stack':29B 'state':65B 'submiss':352C 'sync':274C,279C,289C,294C 'synchron':166C 'task':226C,249C 'teardown':5A,52B,316C 'timeout':39B,142C,318C 'trace':213C 'transmiss':42B,307C 'transmit':123C,337C 'trigger':50B 'tx':132C,175C,210C,220C,327C 'unlik':341C 'unlink':162C 'updat':121C 'use':9A,31B,116C,180C,198C 'use-after-fre':8A,179C 'vulner':76C 'without':125C 'work':211C,221C,295C 'workqueu':147C,207C 'x105/0x1f0':287C 'x110d/0x1b60':241C 'x11f/0x170':255C 'x12/0xa30':236C 'x13c/0x290':297C 'x150/0x250':270C 'x157/0x290':291C 'x310/0x530':246C 'x3e3/0x800':276C 'x4f1/0x800':260C 'x5e6/0xb70':223C 'x7e/0xc0':282C 'x88c/0xd30':265C 'x892/0x9b0':206C,218C 'xe3/0x350':232C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the Bluetooth HCI core and L2CAP stack enabled, where ACL connections are created and torn down. Machines without Bluetooth hardware or with the Bluetooth module blacklisted are unlikely to be exposed. The sources do not say which kernel versions are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:27+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98735","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98735","severity":null,"published_at":"2026-10-18T16:17:27+00:00","modified_at":"2026-10-21T13:21:40+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}