CVE-2026-98736Bluetooth: hci_conn: Lock parent access during enhanced SCO setup

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: Lock parent access during enhanced SCO setup Bluetooth: hci_conn: Lock parent access during enhanced SCO setup hci_enhanced_setup_sync() runs on the request workqueue without the hci_dev_lock held by its caller when setup was queued. Its CVSD capability check and find_next_esco_param() dereference conn->parent while the receive workqueue can unlink and release that parent. The following interleaving can cause a use-after-free: hci_enhanced_setup_sync() hci_disconn_complete_evt() load conn->parent hci_dev_lock() hci_conn_del(ACL parent) unlink SCO child drop link's parent reference clear child->parent release ACL parent bt_link_release() kfree(parent) hci_dev_unlock() read parent->features[0][3] The reference held for the queued SCO child does not keep its ACL parent alive after unlinking. Commit 42de40abe25d ("Bluetooth: hci_conn: fix the SCO setup context lifetime") protects the child stored in the queued context, but leaves these parent accesses unprotected. With a 40 ms diagnostic delay after loading conn->parent, an instrumented kernel based on fd179f8a05be, which already contains 42de40abe25d, BUG: KASAN: slab-use-after-free in hci_enhanced_setup_sync+0xda5/0xdf0 Read of size 1 at addr ffff888102204047 by task kworker/u17:0/93 Call Trace: hci_enhanced_setup_sync+0xda5/0xdf0 hci_cmd_sync_work+0x13c/0x290 process_one_work+0x6b4/0x10e0 Allocated by task 92: __hci_conn_add+0x304/0x1df0 hci_connect_acl+0x349/0x3e0 hci_connect_sco+0x3b/0x9a0 sco_sock_connect+0x475/0xca0 Freed by task 94: kfree+0x121/0x3c0 bt_link_release+0x79/0xa0 device_release+0xc8/0x240 kobject_put+0x14d/0x280 hci_conn_del+0x524/0xe30 hci_disconn_complete_evt+0x403/0x8c0 hci_event_packet+0x71b/0xb20 hci_rx_work+0x293/0x730 The accessed address is 71 bytes into the freed ACL parent, at its features[0][3] byte; the queued SCO child is a different object. The diagnostic preserves the loaded parent across the delay, matching the unmodified compiled capability check, and does not change the parent references or teardown path. Hold hci_dev_lock() across the codec switch, including every call to find_next_esco_param(), and release it on all selection errors. Keep configure_datapath_sync() outside the critical section because it waits for HCI events. Preserve parameter selection and existing return values.

Timeline

Scores

No CVSS score yet: neither the CNA, CISA nor NVD has scored this CVE. NVD status: Received.

EPSS (exploitation in 30 days)

0.17% · top 93% of all CVEs (13 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Not scored.

Affected products

• Linux · Linux

  • affected e07a06b4eb417f5271d33ce2240e93c62d98b7b4 – < 48bf3b94c7331e11eaa6c89adc054a7bc7c0382e
  • affected e07a06b4eb417f5271d33ce2240e93c62d98b7b4 – < 70b55855eecb428d446344d827bda8725ce8b312
  • affected e07a06b4eb417f5271d33ce2240e93c62d98b7b4 – < 1239ef0fa809b5952fca679db3faa3e1c00e1dac
  • affected e07a06b4eb417f5271d33ce2240e93c62d98b7b4 – < cabd58d9bb66d49d481f762ce986173db397435d
  • affected e07a06b4eb417f5271d33ce2240e93c62d98b7b4 – < 93a737e4e042f59673cd580d35214f278d7b757d
  • affected e07a06b4eb417f5271d33ce2240e93c62d98b7b4 – < 024e05f73a4c1263d031614bc36700ec135eecb4

• Linux · Linux

  • affected 6.1
  • unaffected < 6.1
  • unaffected 6.1.191 – ≤ 6.1.*
  • unaffected 6.6.160 – ≤ 6.6.*
  • unaffected 6.12.113 – ≤ 6.12.*
  • unaffected 6.18.56 – ≤ 6.18.*
  • unaffected 7.2.10 – ≤ 7.2.*
  • unaffected 7.3 – ≤ *

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• EUVD EUVD-2026-103821 (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-98736](https://cveledger.app/badge/CVE-2026-98736.svg)](https://cveledger.app/cve/CVE-2026-98736)

Record last updated 30 Oct 2026, 12:39 UTC.