{"id":"CVE-2026-99014","kind":"vulnerability","aliases":["CVE-2026-99014"],"related":[],"title":"Linux kernel Bluetooth: use-after-free in passive scan setup","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: Fix command skb lifetime during scan setup\n\nDuring PA sync scan setup, hci_le_set_ext_scan_param_sync() gets the\naddress used for the PA_LINK lookup from hci_sent_cmd_data(). The\nreturned pointer borrows storage from sent_cmd or req_skb, without\nholding a reference to either skb.\n\nThe scan worker runs on req_workqueue while hci_cmd_work() runs on the\nseparate device workqueue. After the scan worker loads sent_cmd, the\ncommand worker can free and replace it before hci_sent_cmd_data()\ndereferences the skb. The command payload can also be freed between\nreturning from the helper and comparing the address. The connection\nlookup's RCU critical section does not protect the command skb.\n\nKASAN reported:\n\n  BUG: KASAN: slab-use-after-free in hci_sent_cmd_data+0x27c/0x2f0\n  Workqueue: hci0 hci_cmd_sync_work\n  Call Trace:\n   hci_sent_cmd_data+0x27c/0x2f0\n   hci_le_set_scan_param_sync+0x43a/0x850\n   hci_passive_scan_sync+0xb09/0x1460\n   hci_update_passive_scan_sync+0x47c/0x6e0\n   hci_le_pa_create_sync+0x200/0xa70\n   hci_cmd_sync_work+0x13c/0x290\n\n  Allocated by task 95:\n   skb_clone+0x13f/0x340\n   hci_cmd_work+0x2a9/0x7e0\n\n  Freed by task 95:\n   kmem_cache_free+0xba/0x3a0\n   hci_cmd_work+0x29c/0x7e0\n\nUse hdev->lock to serialize the address snapshot with sent_cmd\nreplacement. Protect req_skb replacement and completion cleanup with\nthe same lock because the helper falls back to that skb. Copy the\naddress before releasing the lock and use the copy for the existing\nRCU-protected connection lookup. Release the mutex before sending or\nwaiting for commands, preserving the lookup and completion ordering.","summary":"A race in the Linux kernel Bluetooth stack lets a command buffer be freed while still in use during passive scan setup, which KASAN reports as a slab use-after-free. The sources do not say what an attacker can gain beyond a kernel memory corruption crash.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bluetooth","linux-kernel","package"],"not_affected_if":["no-bluetooth-hardware"],"how_to_check":"- unknown","fix":"- Install the Linux kernel release that contains the upstream commit fixing hci_sync command skb lifetime; the sources do not name the version.","status":"open","published_at":"2026-10-23T13:17:24+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:55:44+00:00","updated_at":"2026-10-25T04:55:44+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T04:55:44Z","model":"claude-haiku-5-5","output":{"fix":"- Install the Linux kernel release that contains the upstream commit fixing hci_sync command skb lifetime; the sources do not name the version.","reach":"unknown","title":"Linux kernel Bluetooth: use-after-free in passive scan setup","impact":"medium","summary":"A race in the Linux kernel Bluetooth stack lets a command buffer be freed while still in use during passive scan setup, which KASAN reports as a slab use-after-free. The sources do not say what an attacker can gain beyond a kernel memory corruption crash.","category":"package","nicknames":[],"who_cares":["linux-kernel","bluetooth"],"confidence":0.5,"needs_auth":"unknown","worst_case":"kernel memory corruption from a use-after-free during Bluetooth scan setup","analyst_note":"Find the affected kernel version range and the fixing commit in the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-99014) or the kernel stable tree, and check whether a remote trigger exists.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-bluetooth-hardware"],"who_is_affected":"Systems running a Linux kernel with Bluetooth support and the hci_sync passive scan path, such as machines using Bluetooth LE scanning or periodic advertising sync. The sources do not say which kernel versions are affected or whether a remote attacker can reach the bug.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000666,"input_tokens":3956,"output_tokens":541,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':218C,232C,240C,246C,253C,260C,266C,274C,279C,288C,293C '-2026':13A,16A '-99014':14A,17A '95':271C,284C 'address':105C,190C,301C,328C 'alloc':268C 'also':179C 'attack':62B 'back':322C 'beyond':65B 'bluetooth':3A,18B,29B,81C 'borrow':120C 'buffer':34B 'bug':206C 'cach':286C 'call':226C 'cleanup':313C 'clone':273C 'cmd':115C,124C,144C,158C,170C,216C,223C,230C,263C,277C,291C,305C 'command':33B,85C,160C,176C,202C,353C 'compar':188C 'complet':312C,358C 'connect':192C,343C 'copi':326C,336C 'corrupt':69B 'crash':70B 'creat':258C 'critic':196C 'cve':12A,15A 'data':116C,171C,217C,231C 'derefer':172C 'devic':150C 'either':133C 'exist':339C 'ext':99C 'fall':321C 'fix':84C 'follow':76C 'free':7A,54B,163C,212C,287C 'freed':36B,181C,281C 'gain':64B 'get':103C 'hci':82C,96C,113C,143C,168C,214C,222C,228C,234C,242C,248C,255C,262C,276C,290C 'hci0':221C 'hdev':296C 'helper':186C,320C 'hold':129C 'kasan':46B,204C,207C 'kernel':2A,21B,28B,67B,74C 'kmem':285C 'le':97C,235C,256C 'let':31B 'lifetim':87C 'link':110C 'linux':1A,20B,27B,73C 'linux-kernel':19B 'load':156C 'lock':297C,317C,332C 'lookup':111C,193C,344C,356C 'memori':68B 'mutex':347C 'order':359C 'pa':92C,109C,257C 'packag':22B 'param':101C,238C 'passiv':9A,42B,243C,250C 'payload':177C 'pointer':119C 'preserv':354C 'protect':200C,307C,342C 'race':24B 'rcu':195C,341C 'rcu-protect':340C 'refer':131C 'releas':330C,345C 'replac':165C,306C,310C 'report':47B,205C 'req':126C,140C,308C 'resolv':80C 'return':118C,183C 'run':138C,146C 'say':59B 'scan':10A,43B,89C,94C,100C,136C,154C,237C,244C,251C 'section':197C 'send':349C 'sent':114C,123C,157C,169C,215C,229C,304C 'separ':149C 'serial':299C 'set':98C,236C 'setup':11A,44B,90C,95C 'skb':86C,127C,134C,174C,203C,272C,309C,325C 'slab':50B,209C 'slab-use-after-fre':208C 'snapshot':302C 'sourc':56B 'stack':30B 'still':38B 'storag':121C 'sync':83C,93C,102C,224C,239C,245C,252C,259C,264C 'task':270C,283C 'trace':227C 'updat':249C 'use':5A,40B,52B,106C,210C,295C,334C 'use-after-fre':4A,51B 'vulner':77C 'wait':351C 'without':128C 'work':145C,225C,265C,278C,292C 'worker':137C,155C,161C 'workqueu':141C,151C,220C 'x13c/0x290':267C 'x13f/0x340':275C 'x200/0xa70':261C 'x27c/0x2f0':219C,233C 'x29c/0x7e0':294C 'x2a9/0x7e0':280C 'x43a/0x850':241C 'x47c/0x6e0':254C 'xb09/0x1460':247C 'xba/0x3a0':289C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with Bluetooth support and the hci_sync passive scan path, such as machines using Bluetooth LE scanning or periodic advertising sync. The sources do not say which kernel versions are affected or whether a remote attacker can reach the bug.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:24+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99014","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99014","severity":null,"published_at":"2026-10-23T13:17:24+00:00","modified_at":"2026-10-23T13:17:24+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}