Description
In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_core: Serialize fragmented ISO packet queueing

The fragmented path in hci_queue_iso() calls __skb_queue_tail() without
holding conn->data_q.lock. The socket lock serializes senders, but the
transmit worker can concurrently remove packets from this queue using
skb_dequeue().

After an insertion saves the old tail pointer, hci_sched_iso() can dequeue
that packet and pass it to the driver. The driver can free the packet
before the insertion resumes and writes to the old tail's next pointer,
causing a use-after-free. Concurrent updates can also corrupt the queue.

KASAN reported:

BUG: KASAN: slab-use-after-free in hci_send_iso+0xc7d/0xe10
Call Trace:
hci_send_iso+0xc7d/0xe10
iso_sock_sendmsg+0x710/0x900
__sys_sendto+0x34a/0x3a0

Allocated by task 86:
__alloc_skb+0xdd/0x820
alloc_skb_with_frags+0x7e/0x770
sock_alloc_send_pskb+0x67a/0x820
bt_skb_sendmsg.constprop.0+0xc0/0x6c0
iso_sock_sendmsg+0x44e/0x900

Freed by task 90:
kmem_cache_free+0xcb/0x3d0
vhci_read+0x33f/0x4d0
vfs_read+0x177/0xa20

Hold the queue lock across the entire fragment batch, as hci_queue_acl()
does, to serialize insertion against dequeue while preserving fragment
ordering.
Published: 2026-10-18
Score: n/a
EPSS: n/a
KEV: No
Impact: Kernel memory corruption via a use‑after‑free in the Bluetooth HCI core
Action: Patch Immediately
AI Analysis

Impact

The flaw in the Linux kernel’s Bluetooth HCI core allows an attacker who can send fragmented ISO packets to cause a use‑after‑free during packet queueing. The bug can corrupt kernel memory or lead to a crash, potentially granting local code execution in kernel mode or causing denial of service. The vulnerability is a classic use‑after‑free that can be triggered by feeding malformed data to the Bluetooth stack.

Affected Systems

Any Linux system using the Linux kernel with the affected Bluetooth HCI core implementation is susceptible. The issue is not limited to a particular distribution but applies to all kernel versions that include the unpatched hci_queue_iso() routine. Linux kernel releases that had not yet incorporated the patch from the specified Git commits remain vulnerable.

Risk and Exploitability

The problem is a kernel‑level use‑after‑free and could be exploited by a local attacker capable of delivering malicious Bluetooth ISO packets. Because the flaw involves concurrent queue manipulation, a skilled adversary could trigger memory corruption or a system crash. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the lack of a public exploit does not reduce the risk to a system with exposed Bluetooth interfaces. The attack vector is inferred to be local over Bluetooth, and the impact could be root escalation or service interruption.

Generated by OpenCVE AI on October 18, 2026 at 19:12 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Linux kernel update that serializes ISO packet queueing and removes the use‑after‑free bug
  • Disable the Bluetooth service if the host does not require Bluetooth communication
  • Restrict Bluetooth visibility to authorized devices and block untrusted pairing requests

Generated by OpenCVE AI on October 18, 2026 at 19:12 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 18 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416

Sun, 18 Oct 2026 16:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Serialize fragmented ISO packet queueing The fragmented path in hci_queue_iso() calls __skb_queue_tail() without holding conn->data_q.lock. The socket lock serializes senders, but the transmit worker can concurrently remove packets from this queue using skb_dequeue(). After an insertion saves the old tail pointer, hci_sched_iso() can dequeue that packet and pass it to the driver. The driver can free the packet before the insertion resumes and writes to the old tail's next pointer, causing a use-after-free. Concurrent updates can also corrupt the queue. KASAN reported: BUG: KASAN: slab-use-after-free in hci_send_iso+0xc7d/0xe10 Call Trace: hci_send_iso+0xc7d/0xe10 iso_sock_sendmsg+0x710/0x900 __sys_sendto+0x34a/0x3a0 Allocated by task 86: __alloc_skb+0xdd/0x820 alloc_skb_with_frags+0x7e/0x770 sock_alloc_send_pskb+0x67a/0x820 bt_skb_sendmsg.constprop.0+0xc0/0x6c0 iso_sock_sendmsg+0x44e/0x900 Freed by task 90: kmem_cache_free+0xcb/0x3d0 vhci_read+0x33f/0x4d0 vfs_read+0x177/0xa20 Hold the queue lock across the entire fragment batch, as hci_queue_acl() does, to serialize insertion against dequeue while preserving fragment ordering.
Title Bluetooth: hci_core: Serialize fragmented ISO packet queueing
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-10-18T15:47:11.210Z

Reserved: 2026-09-25T10:25:14.367Z

Link: CVE-2026-98733

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-18T16:17:26.900

Modified: 2026-10-18T16:17:26.900

Link: CVE-2026-98733

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-18T19:15:14Z

Weaknesses