CVE-2026-98737 - Vulnerability Details

- Bluetooth: hci_sync: Fix inquiry cache use-after-free

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_sync: Fix inquiry cache use-after-free

The sync command worker holds hdev->req_lock, but inquiry-cache updates
and flushes use hdev->lock. Both hci_acl_create_conn_sync() and
hci_stop_discovery_sync() look up entries and read their fields without
taking hdev->lock.

After either lookup returns, a concurrent HCIINQUIRY ioctl can acquire
hdev->lock and flush the cache, freeing the entry. The worker then reads
the freed entry while preparing a create-connection or remote-name-cancel
command. The list traversal also races with cache updates and removal.

KASAN reported these accesses:

BUG: KASAN: slab-use-after-free in hci_acl_create_conn_sync+0x5f1/0x650
Workqueue: hci0 hci_cmd_sync_work
Call Trace:
hci_acl_create_conn_sync+0x5f1/0x650
hci_cmd_sync_work+0x13c/0x290

Allocated by task 90:
hci_inquiry_cache_update+0x3e6/0x7d0
hci_inquiry_result_evt+0x3cb/0x560

Freed by task 93:
hci_inquiry_cache_flush+0x111/0x2b0
hci_inquiry+0x2f2/0x780
hci_sock_ioctl+0x269/0x5f0

BUG: KASAN: slab-use-after-free in hci_stop_discovery_sync+0x3b1/0x3c0
Workqueue: hci0 hci_cmd_sync_work
Call Trace:
hci_stop_discovery_sync+0x3b1/0x3c0
hci_cmd_sync_work+0x173/0x300

Allocated by task 86:
hci_inquiry_cache_update+0x483/0x940
hci_inquiry_result_evt+0x3cb/0x560

Freed by task 91:
hci_inquiry_cache_flush+0x13e/0x2f0
hci_inquiry+0x2f2/0x780
hci_sock_ioctl+0x269/0x5f0

Hold hdev->lock across each lookup and all reads from its result. Copy the
remote address before unlocking so discovery cancellation does not retain
a cache entry pointer. Release the lock before sending synchronous HCI
commands, since their completion handlers may need the same lock.

Published: 2026-10-18

Score: 4.7 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability arises from a concurrency bug in the Linux kernel’s Bluetooth stack. The sync command worker may access a freed inquiry‑cache entry, leading to a use‑after‑free and kernel memory corruption. An attacker that can trigger the race can cause a crash or enable arbitrary code execution with kernel privileges.

Affected Systems

All Linux kernel versions that include the Bluetooth hci_sync implementation prior to the patch at commit 333257e6e4a7bcaaea82fd357121d0f1e6b76c7b are affected. The exposure spans the generic Linux kernel and any distribution kernel images that ship with the unpatched code. No specific vendor or minor version is listed, so the impact is broad across all affected distributions.

Risk and Exploitability

The CVSS score is 4.7, reflecting medium severity kernel fault. The use‑after‑free is a known flaw that can lead to privilege escalation if an attacker can trigger the race. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited exploitation data. The likely attack vector is a local or network‑based Bluetooth client; an attacker would need to send a crafted HCIINQUIRY ioctl while a sync command is executing, so tight control over Bluetooth is required. Kernel patches should still be applied promptly.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`cf75ad8b41d2aa06f98f365d42a3ae8b059daddd`	affected	< ddc9edb244cc8b5266595e8fc220e7813f2b603a
`cf75ad8b41d2aa06f98f365d42a3ae8b059daddd`	affected	< 52edf1c0e59dea37b8368c4a2559dca96b2fdfea
`cf75ad8b41d2aa06f98f365d42a3ae8b059daddd`	affected	< 333257e6e4a7bcaaea82fd357121d0f1e6b76c7b
`cf75ad8b41d2aa06f98f365d42a3ae8b059daddd`	affected	< a642f498f0b08f2aa9f4a69468db92f57a72349d
`cf75ad8b41d2aa06f98f365d42a3ae8b059daddd`	affected	< 8ed67535fdff40ca652bcd4ac7da68d11d01bd34

Linux

affected

Version	Status	Constraints
`5.17`	affected	—
`0`	unaffected	< 5.17
`6.6.160`	unaffected	≤ 6.6.*
`6.12.113`	unaffected	≤ 6.12.*
`6.18.56`	unaffected	≤ 6.18.*
`7.2.10`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[cf75ad8b41d2aa06f98f365d42a3ae8b059daddd,52edf1c0e59dea37b8368c4a2559dca96b2fdfea)`	affected	code_commit	—
`[cf75ad8b41d2aa06f98f365d42a3ae8b059daddd,333257e6e4a7bcaaea82fd357121d0f1e6b76c7b)`	affected	code_commit	—
`[cf75ad8b41d2aa06f98f365d42a3ae8b059daddd,a642f498f0b08f2aa9f4a69468db92f57a72349d)`	affected	code_commit	—
`[cf75ad8b41d2aa06f98f365d42a3ae8b059daddd,8ed67535fdff40ca652bcd4ac7da68d11d01bd34)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.17`	affected	generic	—
`[0,5.17)`	unaffected	generic	—
`[6.12.113,6.13.0)`	unaffected	semver	—
`[6.18.56,6.19.0)`	unaffected	semver	—
`[7.2.10,7.3.0)`	unaffected	semver	—
`[7.3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the Linux kernel to a patched version that contains the hci_sync fix.
Verify that the running kernel includes the relevant commit after an upgrade or apply the patch directly if vendor updates are not yet available.
If a kernel upgrade cannot be performed immediately, disable or restrict Bluetooth services on the affected hosts to prevent the race condition from being triggered.

Generated by OpenCVE AI on October 22, 2026 at 21:04 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4850-1	linux-6.12 security update

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.002.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/333257e6e4a7bcaaea82fd357121d0f1e6b76c7b
https://git.kernel.org/stable/c/52edf1c0e59dea37b8368c4a2559dca96b2fdfea
https://git.kernel.org/stable/c/8ed67535fdff40ca652bcd4ac7da68d11d01bd34
https://git.kernel.org/stable/c/a642f498f0b08f2aa9f4a69468db92f57a72349d
https://git.kernel.org/stable/c/ddc9edb244cc8b5266595e8fc220e7813f2b603a
https://kernelcve.org/list/?q=CVE-2026-98737
https://nvd.nist.gov/vuln/detail/CVE-2026-98737
https://www.cve.org/CVERecord?id=CVE-2026-98737

History

Wed, 21 Oct 2026 13:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/ddc9edb244cc8b5266595e8fc220e7813f2b603a

Wed, 21 Oct 2026 12:30:00 +0000

Type	Values Removed	Values Added
References		https://kernelcve.org/list/?q=CVE-2026-98737 https://nvd.nist.gov/vuln/detail/CVE-2026-98737 https://www.cve.org/CVERecord?id=CVE-2026-98737
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sun, 18 Oct 2026 20:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Sun, 18 Oct 2026 16:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Fix inquiry cache use-after-free The sync command worker holds hdev->req_lock, but inquiry-cache updates and flushes use hdev->lock. Both hci_acl_create_conn_sync() and hci_stop_discovery_sync() look up entries and read their fields without taking hdev->lock. After either lookup returns, a concurrent HCIINQUIRY ioctl can acquire hdev->lock and flush the cache, freeing the entry. The worker then reads the freed entry while preparing a create-connection or remote-name-cancel command. The list traversal also races with cache updates and removal. KASAN reported these accesses: BUG: KASAN: slab-use-after-free in hci_acl_create_conn_sync+0x5f1/0x650 Workqueue: hci0 hci_cmd_sync_work Call Trace: hci_acl_create_conn_sync+0x5f1/0x650 hci_cmd_sync_work+0x13c/0x290 Allocated by task 90: hci_inquiry_cache_update+0x3e6/0x7d0 hci_inquiry_result_evt+0x3cb/0x560 Freed by task 93: hci_inquiry_cache_flush+0x111/0x2b0 hci_inquiry+0x2f2/0x780 hci_sock_ioctl+0x269/0x5f0 BUG: KASAN: slab-use-after-free in hci_stop_discovery_sync+0x3b1/0x3c0 Workqueue: hci0 hci_cmd_sync_work Call Trace: hci_stop_discovery_sync+0x3b1/0x3c0 hci_cmd_sync_work+0x173/0x300 Allocated by task 86: hci_inquiry_cache_update+0x483/0x940 hci_inquiry_result_evt+0x3cb/0x560 Freed by task 91: hci_inquiry_cache_flush+0x13e/0x2f0 hci_inquiry+0x2f2/0x780 hci_sock_ioctl+0x269/0x5f0 Hold hdev->lock across each lookup and all reads from its result. Copy the remote address before unlocking so discovery cancellation does not retain a cache entry pointer. Release the lock before sending synchronous HCI commands, since their completion handlers may need the same lock.
Title		Bluetooth: hci_sync: Fix inquiry cache use-after-free
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/333257e6e4a7bcaaea82fd357121d0f1e6b76c7b https://git.kernel.org/stable/c/52edf1c0e59dea37b8368c4a2559dca96b2fdfea https://git.kernel.org/stable/c/8ed67535fdff40ca652bcd4ac7da68d11d01bd34 https://git.kernel.org/stable/c/a642f498f0b08f2aa9f4a69468db92f57a72349d

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-18T15:47:14.936Z

Updated: 2026-10-21T12:56:13.421Z

Reserved: 2026-09-25T10:25:14.367Z

Link: CVE-2026-98737

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-18T16:17:27.370

Modified: 2026-10-21T13:21:40.930

Link: CVE-2026-98737

Redhat

Severity : Moderate

Publid Date: 2026-10-18T15:47:14Z

Links: CVE-2026-98737 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-22T21:15:12Z

Weaknesses

CWE-416
Use After Free

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object