{"id":"CVE-2026-98736","kind":"vulnerability","aliases":["CVE-2026-98736"],"related":[],"title":"Linux kernel Bluetooth: use-after-free reading freed ACL parent during SCO setup","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_conn: Lock parent access during enhanced SCO setup\n\nBluetooth: hci_conn: Lock parent access during enhanced SCO setup\n\nhci_enhanced_setup_sync() runs on the request workqueue without the\nhci_dev_lock held by its caller when setup was queued. Its CVSD\ncapability check and find_next_esco_param() dereference conn->parent\nwhile the receive workqueue can unlink and release that parent.\n\nThe following interleaving can cause a use-after-free:\n\n  hci_enhanced_setup_sync()       hci_disconn_complete_evt()\n  load conn->parent\n                                 hci_dev_lock()\n                                 hci_conn_del(ACL parent)\n                                   unlink SCO child\n                                   drop link's parent reference\n                                   clear child->parent\n                                   release ACL parent\n                                     bt_link_release()\n                                       kfree(parent)\n                                 hci_dev_unlock()\n  read parent->features[0][3]\n\nThe reference held for the queued SCO child does not keep its ACL parent\nalive after unlinking. Commit 42de40abe25d (\"Bluetooth: hci_conn: fix the\nSCO setup context lifetime\") protects the child stored in the queued\ncontext, but leaves these parent accesses unprotected.\n\nWith a 40 ms diagnostic delay after loading conn->parent, an instrumented\nkernel based on fd179f8a05be, which already contains 42de40abe25d,\n\n  BUG: KASAN: slab-use-after-free in hci_enhanced_setup_sync+0xda5/0xdf0\n  Read of size 1 at addr ffff888102204047 by task kworker/u17:0/93\n  Call Trace:\n   hci_enhanced_setup_sync+0xda5/0xdf0\n   hci_cmd_sync_work+0x13c/0x290\n   process_one_work+0x6b4/0x10e0\n\n  Allocated by task 92:\n   __hci_conn_add+0x304/0x1df0\n   hci_connect_acl+0x349/0x3e0\n   hci_connect_sco+0x3b/0x9a0\n   sco_sock_connect+0x475/0xca0\n\n  Freed by task 94:\n   kfree+0x121/0x3c0\n   bt_link_release+0x79/0xa0\n   device_release+0xc8/0x240\n   kobject_put+0x14d/0x280\n   hci_conn_del+0x524/0xe30\n   hci_disconn_complete_evt+0x403/0x8c0\n   hci_event_packet+0x71b/0xb20\n   hci_rx_work+0x293/0x730\n\nThe accessed address is 71 bytes into the freed ACL parent, at its\nfeatures[0][3] byte; the queued SCO child is a different object. The\ndiagnostic preserves the loaded parent across the delay, matching the\nunmodified compiled capability check, and does not change the parent\nreferences or teardown path.\n\nHold hci_dev_lock() across the codec switch, including every call to\nfind_next_esco_param(), and release it on all selection errors. Keep\nconfigure_datapath_sync() outside the critical section because it waits\nfor HCI events. Preserve parameter selection and existing return values.","summary":"A race in the Linux kernel Bluetooth stack lets enhanced SCO setup read an ACL parent connection object after a disconnect event has freed it. The read is a use-after-free that could crash the kernel or let a local attacker influence kernel memory.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bluetooth","kernel-upgrade","linux-kernel","package"],"not_affected_if":["bluetooth-disabled","no-bluetooth-hardware"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-18T16:17:27+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:17:08+00:00","updated_at":"2026-10-25T05:17:08+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T05:17:08Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel Bluetooth: use-after-free reading freed ACL parent during SCO setup","impact":"high","summary":"A race in the Linux kernel Bluetooth stack lets enhanced SCO setup read an ACL parent connection object after a disconnect event has freed it. The read is a use-after-free that could crash the kernel or let a local attacker influence kernel memory.","category":"package","nicknames":[],"who_cares":["linux-kernel","bluetooth","kernel-upgrade"],"confidence":0.6,"needs_auth":"unknown","worst_case":"kernel memory corruption or crash from freed object read","analyst_note":"Check the kernel.org stable commit fixing hci_enhanced_setup_sync for fixed kernel versions and the trigger requirements.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-bluetooth-hardware","bluetooth-disabled"],"who_is_affected":"Systems running a Linux kernel that includes commit 42de40abe25d without the locking fix. Machines without Bluetooth or with Bluetooth SCO audio unused are unlikely to be exposed. The sources do not list fixed kernel versions.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000665,"input_tokens":4307,"output_tokens":468,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':279C,298C,304C,309C,318C,323C,328C,333C,340C,345C,349C,353C,358C,364C,369C,374C '-2026':16A,19A '-98736':17A,20A '0':203C,390C '0/93':291C '1':284C '3':204C,391C '40':249C '42de40abe25d':223C,266C '71':380C '92':314C '94':338C 'access':90C,100C,245C,377C 'acl':10A,43B,176C,190C,217C,322C,385C 'across':407C,430C 'add':317C 'addr':286C 'address':378C 'aliv':219C 'alloc':311C 'alreadi':264C 'attack':71B 'base':260C 'bluetooth':3A,21B,35B,85C,95C,224C 'bt':192C,342C 'bug':267C 'byte':381C,392C 'call':292C,436C 'caller':122C 'capabl':129C,414C 'caus':153C 'chang':419C 'check':130C,415C 'child':180C,187C,212C,235C,396C 'clear':186C 'cmd':301C 'codec':432C 'commit':222C 'compil':413C 'complet':165C,362C 'configur':450C 'conn':87C,97C,137C,168C,174C,226C,255C,316C,356C 'connect':45B,321C,326C,332C 'contain':265C 'context':231C,240C 'could':63B 'crash':64B 'critic':455C 'cve':15A,18A 'cvsd':128C 'datapath':451C 'del':175C,357C 'delay':252C,409C 'derefer':136C 'dev':117C,171C,198C,428C 'devic':347C 'diagnost':251C,402C 'differ':399C 'disconn':164C,361C 'disconnect':49B 'drop':181C 'enhanc':38B,92C,102C,106C,160C,276C,295C 'error':448C 'esco':134C,440C 'event':50B,367C,462C 'everi':435C 'evt':166C,363C 'exist':467C 'fd179f8a05be':262C 'featur':202C,389C 'ffff888102204047':287C 'find':132C,438C 'fix':227C 'follow':80C,150C 'free':7A,61B,158C,273C 'freed':9A,52B,335C,384C 'hci':86C,96C,105C,116C,159C,163C,170C,173C,197C,225C,275C,294C,300C,315C,320C,325C,355C,360C,366C,371C,427C,461C 'held':119C,207C 'hold':426C 'includ':434C 'influenc':72B 'instrument':258C 'interleav':151C 'kasan':268C 'keep':215C,449C 'kernel':2A,23B,27B,34B,66B,73B,78C,259C 'kernel-upgrad':22B 'kfree':195C,339C 'kobject':351C 'kworker/u17':290C 'leav':242C 'let':37B,68B 'lifetim':232C 'link':182C,193C,343C 'linux':1A,26B,33B,77C 'linux-kernel':25B 'load':167C,254C,405C 'local':70B 'lock':88C,98C,118C,172C,429C 'match':410C 'memori':74B 'ms':250C 'next':133C,439C 'object':46B,400C 'one':307C 'outsid':453C 'packag':28B 'packet':368C 'param':135C,441C 'paramet':464C 'parent':11A,44B,89C,99C,138C,148C,169C,177C,184C,188C,191C,196C,201C,218C,244C,256C,386C,406C,421C 'path':425C 'preserv':403C,463C 'process':306C 'protect':233C 'put':352C 'queu':126C,210C,239C,394C 'race':30B 'read':8A,41B,55B,200C,281C 'receiv':141C 'refer':185C,206C,422C 'releas':146C,189C,194C,344C,348C,443C 'request':112C 'resolv':84C 'return':468C 'run':109C 'rx':372C 'sco':13A,39B,93C,103C,179C,211C,229C,327C,330C,395C 'section':456C 'select':447C,465C 'setup':14A,40B,94C,104C,107C,124C,161C,230C,277C,296C 'size':283C 'slab':270C 'slab-use-after-fre':269C 'sock':331C 'stack':36B 'store':236C 'switch':433C 'sync':108C,162C,278C,297C,302C,452C 'task':289C,313C,337C 'teardown':424C 'trace':293C 'unlink':144C,178C,221C 'unlock':199C 'unmodifi':412C 'unprotect':246C 'upgrad':24B 'use':5A,59B,156C,271C 'use-after-fre':4A,58B,155C 'valu':469C 'vulner':81C 'wait':459C 'without':114C 'work':303C,308C,373C 'workqueu':113C,142C 'x121/0x3c0':341C 'x13c/0x290':305C 'x14d/0x280':354C 'x293/0x730':375C 'x304/0x1df0':319C 'x349/0x3e0':324C 'x3b/0x9a0':329C 'x403/0x8c0':365C 'x475/0xca0':334C 'x524/0xe30':359C 'x6b4/0x10e0':310C 'x71b/0xb20':370C 'x79/0xa0':346C 'xc8/0x240':350C 'xda5/0xdf0':280C,299C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel that includes commit 42de40abe25d without the locking fix. Machines without Bluetooth or with Bluetooth SCO audio unused are unlikely to be exposed. The sources do not list fixed kernel versions.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:27+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98736","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98736","severity":null,"published_at":"2026-10-18T16:17:27+00:00","modified_at":"2026-10-21T13:21:40+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}