CVE-2026-98733 - Vulnerability Details

- Bluetooth: hci_core: Serialize fragmented ISO packet queueing

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_core: Serialize fragmented ISO packet queueing

The fragmented path in hci_queue_iso() calls __skb_queue_tail() without
holding conn->data_q.lock. The socket lock serializes senders, but the
transmit worker can concurrently remove packets from this queue using
skb_dequeue().

After an insertion saves the old tail pointer, hci_sched_iso() can dequeue
that packet and pass it to the driver. The driver can free the packet
before the insertion resumes and writes to the old tail's next pointer,
causing a use-after-free. Concurrent updates can also corrupt the queue.

KASAN reported:

BUG: KASAN: slab-use-after-free in hci_send_iso+0xc7d/0xe10
Call Trace:
hci_send_iso+0xc7d/0xe10
iso_sock_sendmsg+0x710/0x900
__sys_sendto+0x34a/0x3a0

Allocated by task 86:
__alloc_skb+0xdd/0x820
alloc_skb_with_frags+0x7e/0x770
sock_alloc_send_pskb+0x67a/0x820
bt_skb_sendmsg.constprop.0+0xc0/0x6c0
iso_sock_sendmsg+0x44e/0x900

Freed by task 90:
kmem_cache_free+0xcb/0x3d0
vhci_read+0x33f/0x4d0
vfs_read+0x177/0xa20

Hold the queue lock across the entire fragment batch, as hci_queue_acl()
does, to serialize insertion against dequeue while preserving fragment
ordering.

Published: 2026-10-18

Score: 7.0 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The flaw occurs when fragmented ISO packets are queued in the Linux kernel Bluetooth HCI core without holding the proper queue lock. This race condition can lead to a use‑after‑free of a socket buffer that has already been freed by the driver, corrupting kernel memory or causing a crash. The resulting memory corruption could allow a local attacker to execute code with elevated privileges or to disrupt service through denial of service.

Affected Systems

Any Linux system running a kernel that includes the unpatched hci_queue_iso() routine is vulnerable. The issue is unrelated to a specific distribution and applies to all kernel releases until the patch that introduces explicit lock serialization is applied.

Risk and Exploitability

The vulnerability has a CVSS score of 7.0 and an EPSS of < 1%, indicating a low but nonzero probability of exploitation. It is not listed in the CISA KEV catalog. The attack vector is inferred to be local over Bluetooth, requiring the attacker to send malicious fragmented ISO packets to the target device. While no public exploit is known, the potential for kernel memory corruption warrants immediate attention.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`26afbd826ee326e63a334c37fd45e82e50a615ec`	affected	< e328b5823fa6b0b160d0922d6d68323e910d09a4
`26afbd826ee326e63a334c37fd45e82e50a615ec`	affected	< 545fa70f730eb648a610a2f4b2d270865f77b619
`26afbd826ee326e63a334c37fd45e82e50a615ec`	affected	< d6d709981208567868c5c01ebd1bec5e5e7fdab0
`26afbd826ee326e63a334c37fd45e82e50a615ec`	affected	< 708cdd203d0bbcf9255fffb2e4c308d5b28851a7
`26afbd826ee326e63a334c37fd45e82e50a615ec`	affected	< a7161730a3ab3f0a3896000db7ab0284683936e6
`26afbd826ee326e63a334c37fd45e82e50a615ec`	affected	< 1a572db43c057566771b485598ad2e66cb390821

Linux

affected

Version	Status	Constraints
`6.0`	affected	—
`0`	unaffected	< 6.0
`6.1.191`	unaffected	≤ 6.1.*
`6.6.160`	unaffected	≤ 6.6.*
`6.12.113`	unaffected	≤ 6.12.*
`6.18.56`	unaffected	≤ 6.18.*
`7.2.10`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[26afbd826ee326e63a334c37fd45e82e50a615ec,d6d709981208567868c5c01ebd1bec5e5e7fdab0)`	affected	code_commit	—
`[26afbd826ee326e63a334c37fd45e82e50a615ec,708cdd203d0bbcf9255fffb2e4c308d5b28851a7)`	affected	code_commit	—
`[26afbd826ee326e63a334c37fd45e82e50a615ec,a7161730a3ab3f0a3896000db7ab0284683936e6)`	affected	code_commit	—
`[26afbd826ee326e63a334c37fd45e82e50a615ec,1a572db43c057566771b485598ad2e66cb390821)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.0`	affected	generic	—
`[0,6.0)`	unaffected	generic	—
`[6.12.113,6.13.0)`	unaffected	semver	—
`[6.18.56,6.19.0)`	unaffected	semver	—
`[7.2.10,7.3.0)`	unaffected	semver	—
`[7.3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest Linux kernel update that serializes ISO packet queueing and eliminates the use‑after‑free bug
Disable the Bluetooth service if the host does not need Bluetooth communication
Restrict Bluetooth visibility and block untrusted pairing requests to limit the attack surface

Generated by OpenCVE AI on October 22, 2026 at 21:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4850-1	linux-6.12 security update

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00172.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/1a572db43c057566771b485598ad2e66cb390821
https://git.kernel.org/stable/c/545fa70f730eb648a610a2f4b2d270865f77b619
https://git.kernel.org/stable/c/708cdd203d0bbcf9255fffb2e4c308d5b28851a7
https://git.kernel.org/stable/c/a7161730a3ab3f0a3896000db7ab0284683936e6
https://git.kernel.org/stable/c/d6d709981208567868c5c01ebd1bec5e5e7fdab0
https://git.kernel.org/stable/c/e328b5823fa6b0b160d0922d6d68323e910d09a4
https://kernelcve.org/list/?q=CVE-2026-98733
https://nvd.nist.gov/vuln/detail/CVE-2026-98733
https://www.cve.org/CVERecord?id=CVE-2026-98733

History

Fri, 30 Oct 2026 12:45:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/e328b5823fa6b0b160d0922d6d68323e910d09a4

Wed, 21 Oct 2026 13:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/545fa70f730eb648a610a2f4b2d270865f77b619

Wed, 21 Oct 2026 12:30:00 +0000

Type	Values Removed	Values Added
References		https://kernelcve.org/list/?q=CVE-2026-98733 https://nvd.nist.gov/vuln/detail/CVE-2026-98733 https://www.cve.org/CVERecord?id=CVE-2026-98733
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Sun, 18 Oct 2026 19:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Sun, 18 Oct 2026 16:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Serialize fragmented ISO packet queueing The fragmented path in hci_queue_iso() calls __skb_queue_tail() without holding conn->data_q.lock. The socket lock serializes senders, but the transmit worker can concurrently remove packets from this queue using skb_dequeue(). After an insertion saves the old tail pointer, hci_sched_iso() can dequeue that packet and pass it to the driver. The driver can free the packet before the insertion resumes and writes to the old tail's next pointer, causing a use-after-free. Concurrent updates can also corrupt the queue. KASAN reported: BUG: KASAN: slab-use-after-free in hci_send_iso+0xc7d/0xe10 Call Trace: hci_send_iso+0xc7d/0xe10 iso_sock_sendmsg+0x710/0x900 __sys_sendto+0x34a/0x3a0 Allocated by task 86: __alloc_skb+0xdd/0x820 alloc_skb_with_frags+0x7e/0x770 sock_alloc_send_pskb+0x67a/0x820 bt_skb_sendmsg.constprop.0+0xc0/0x6c0 iso_sock_sendmsg+0x44e/0x900 Freed by task 90: kmem_cache_free+0xcb/0x3d0 vhci_read+0x33f/0x4d0 vfs_read+0x177/0xa20 Hold the queue lock across the entire fragment batch, as hci_queue_acl() does, to serialize insertion against dequeue while preserving fragment ordering.
Title		Bluetooth: hci_core: Serialize fragmented ISO packet queueing
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1a572db43c057566771b485598ad2e66cb390821 https://git.kernel.org/stable/c/708cdd203d0bbcf9255fffb2e4c308d5b28851a7 https://git.kernel.org/stable/c/a7161730a3ab3f0a3896000db7ab0284683936e6 https://git.kernel.org/stable/c/d6d709981208567868c5c01ebd1bec5e5e7fdab0

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-18T15:47:11.210Z

Updated: 2026-10-30T12:39:09.881Z

Reserved: 2026-09-25T10:25:14.367Z

Link: CVE-2026-98733

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-18T16:17:26.900

Modified: 2026-10-30T13:21:22.107

Link: CVE-2026-98733

Redhat

Severity : Moderate

Publid Date: 2026-10-18T15:47:11Z

Links: CVE-2026-98733 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-22T21:15:12Z

Weaknesses

CWE-416
Use After Free

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object