{"id":"CVE-2026-98738","kind":"vulnerability","aliases":["CVE-2026-98738"],"related":[],"title":"Linux kernel: Bluetooth SMP pairing can read freed remote OOB data","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: Serialize SMP remote OOB data access\n\nbuild_pairing_cmd() looks up remote OOB data and copies its contents\nwithout holding hdev->lock, which serializes the list's writers. After\nSMP finds an entry, a concurrent management Remove Remote OOB Data\ncommand can unlink and free it before SMP reads its present flag or\ncopies its random and confirmation values. Removal can also invalidate\nan entry while the lookup is still traversing the list.\n\nKASAN reported:\n\n  BUG: KASAN: slab-use-after-free in build_pairing_cmd+0x948/0x9b0\n  Call Trace:\n   build_pairing_cmd+0x948/0x9b0\n   smp_recv_cb+0x459f/0x8110\n   l2cap_recv_frame+0xf14/0x9190\n   l2cap_recv_acldata+0xa64/0xd40\n   hci_rx_work+0x4ca/0x730\n\n  Allocated by task 87:\n   hci_add_remote_oob_data+0x11d/0x530\n   add_remote_oob_data+0x282/0x400\n   hci_sock_sendmsg+0x1033/0x1ea0\n\n  Freed by task 93:\n   hci_remote_oob_data_clear+0x108/0x1c0\n   remove_remote_oob_data+0x198/0x220\n   hci_sock_sendmsg+0x1033/0x1ea0\n\nTaking hdev->lock in build_pairing_cmd() would recurse for callers that\nalready hold it and invert the device-to-L2CAP lock order on the receive\npath. Add a per-device remote_oob_lock instead, held across the SMP\nlookup and copies and by the add, remove and clear helpers. Cover\ninitialization and in-place updates as well, so SMP cannot read partially\ninitialized or updated OOB values. Release the mutex on allocation\nfailure, preserving the existing error return.\n\nThe new critical sections acquire no device, connection or channel locks.\nWriters retain their existing hdev->lock protection, which continues to\nserialize the other readers without changing their locking or behavior.","summary":"The Linux kernel's Bluetooth SMP pairing code reads remote out-of-band pairing data without a lock, so a concurrent management command can free the entry mid-read, causing a use-after-free. KASAN reports a slab-use-after-free in build_pairing_cmd, which can lead to kernel memory corruption.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bluetooth","linux-kernel","runtime","self-hosted"],"not_affected_if":["no-bluetooth"],"how_to_check":"- unknown","fix":"- Update the Linux kernel to a release that includes the upstream commit adding remote_oob_lock to Bluetooth SMP remote OOB handling (version unknown from sources).","status":"open","published_at":"2026-10-18T16:17:27+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:17:07+00:00","updated_at":"2026-10-25T05:17:07+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T05:17:07Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit adding remote_oob_lock to Bluetooth SMP remote OOB handling (version unknown from sources).","reach":"local","title":"Linux kernel: Bluetooth SMP pairing can read freed remote OOB data","impact":"high","summary":"The Linux kernel's Bluetooth SMP pairing code reads remote out-of-band pairing data without a lock, so a concurrent management command can free the entry mid-read, causing a use-after-free. KASAN reports a slab-use-after-free in build_pairing_cmd, which can lead to kernel memory corruption.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","bluetooth","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"kernel memory corruption; possible code execution in kernel context","analyst_note":"Confirm affected kernel version range and fixed commit from the NVD entry or kernel.org stable advisories; determine whether a remote attacker can reach the path over Bluetooth.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-bluetooth"],"who_is_affected":"Systems running a Linux kernel with Bluetooth enabled that use SMP pairing with remote out-of-band data. Systems without Bluetooth hardware or with the Bluetooth stack disabled are unlikely to be exposed. The sources do not state which kernel versions are affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000672,"input_tokens":3935,"output_tokens":556,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':179C,186C,191C,196C,201C,206C,217C,223C,228C,239C,245C,250C '-2026':13A,16A '-98738':14A,17A '87':211C '93':233C 'access':98C 'acldata':200C 'acquir':338C 'across':290C 'add':213C,219C,280C,299C 'alloc':208C,327C 'alreadi':264C 'also':154C 'band':39B 'behavior':364C 'bluetooth':3A,18B,30B,92C 'bug':168C 'build':72B,99C,176C,183C,256C 'call':181C 'caller':262C 'cannot':315C 'caus':57B 'cb':190C 'chang':360C 'channel':343C 'clear':238C,302C 'cmd':74B,101C,178C,185C,258C 'code':33B 'command':49B,133C 'concurr':47B,127C 'confirm':150C 'connect':341C 'content':110C 'continu':353C 'copi':108C,146C,295C 'corrupt':81B 'cover':304C 'critic':336C 'cve':12A,15A 'data':11A,41B,97C,106C,132C,216C,222C,237C,244C 'devic':271C,284C,340C 'device-to-l2cap':270C 'entri':53B,125C,157C 'error':332C 'exist':331C,348C 'failur':328C 'find':123C 'flag':144C 'follow':87C 'frame':195C 'free':51B,62B,70B,137C,174C 'freed':8A,230C 'hci':203C,212C,225C,234C,247C 'hdev':113C,253C,349C 'held':289C 'helper':303C 'hold':112C,265C 'host':25B 'in-plac':307C 'initi':305C,318C 'instead':288C 'invalid':155C 'invert':268C 'kasan':63B,166C,169C 'kernel':2A,21B,28B,79B,85C 'l2cap':193C,198C,273C 'lead':77B 'linux':1A,20B,27B,84C 'linux-kernel':19B 'list':118C,165C 'lock':44B,114C,254C,274C,287C,344C,350C,362C 'look':102C 'lookup':160C,293C 'manag':48B,128C 'memori':80B 'mid':55B 'mid-read':54B 'mutex':325C 'new':335C 'oob':10A,96C,105C,131C,215C,221C,236C,243C,286C,321C 'order':275C 'out-of-band':36B 'pair':5A,32B,40B,73B,100C,177C,184C,257C 'partial':317C 'path':279C 'per':283C 'per-devic':282C 'place':309C 'present':143C 'preserv':329C 'protect':351C 'random':148C 'read':7A,34B,56B,141C,316C 'reader':358C 'receiv':278C 'recurs':260C 'recv':189C,194C,199C 'releas':323C 'remot':9A,35B,95C,104C,130C,214C,220C,235C,242C,285C 'remov':129C,152C,241C,300C 'report':64B,167C 'resolv':91C 'retain':346C 'return':333C 'runtim':22B 'rx':204C 'section':337C 'self':24B 'self-host':23B 'sendmsg':227C,249C 'serial':93C,116C,355C 'slab':67B,171C 'slab-use-after-fre':66B,170C 'smp':4A,31B,94C,122C,140C,188C,292C,314C 'sock':226C,248C 'still':162C 'take':252C 'task':210C,232C 'trace':182C 'travers':163C 'unlink':135C 'updat':310C,320C 'use':60B,68B,172C 'use-after-fre':59B 'valu':151C,322C 'vulner':88C 'well':312C 'without':42B,111C,359C 'work':205C 'would':259C 'writer':120C,345C 'x1033/0x1ea0':229C,251C 'x108/0x1c0':240C 'x11d/0x530':218C 'x198/0x220':246C 'x282/0x400':224C 'x459f/0x8110':192C 'x4ca/0x730':207C 'x948/0x9b0':180C,187C 'xa64/0xd40':202C 'xf14/0x9190':197C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with Bluetooth enabled that use SMP pairing with remote out-of-band data. Systems without Bluetooth hardware or with the Bluetooth stack disabled are unlikely to be exposed. The sources do not state which kernel versions are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:27+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98738","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98738","severity":null,"published_at":"2026-10-18T16:17:27+00:00","modified_at":"2026-10-21T13:21:41+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}