{"id":41207,"date":"2026-10-19T00:32:37","date_gmt":"2026-10-18T16:32:37","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-98735"},"modified":"2026-10-19T00:32:37","modified_gmt":"2026-10-18T16:32:37","slug":"cve-2026-98735","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-98735","title":{"rendered":"CVE-2026-98735 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_core:"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>Bluetooth: hci_core: Serialize ACL scheduling with channel deletion<\/p>\n<p>hci_chan_sent() selects a channel under RCU but drops the read lock before<br \/>\naccessing chan-&gt;conn and returning the channel. The ACL and LE schedulers<br \/>\nthen use its packet queue and update its transmit counters without any<br \/>\nprotection against channel deletion.<\/p>\n<p>After TX selects a channel and releases RCU, a disconnect command timeout<br \/>\non the separate request workqueue can run hci_conn_failed() and<br \/>\nl2cap_conn_del(). hci_chan_del() can then unlink the channel, complete<br \/>\nsynchronize_rcu(), purge its queue and free it before TX resumes. This<br \/>\ncauses use-after-free both in hci_chan_sent() and in its callers.<\/p>\n<p>KASAN reported:<\/p>\n<p>  BUG: KASAN: slab-use-after-free in hci_chan_sent+0x892\/0x9b0<br \/>\n  Workqueue: hci0 hci_tx_work<br \/>\n  Call Trace:<br \/>\n   hci_chan_sent+0x892\/0x9b0<br \/>\n   hci_tx_work+0x5e6\/0xb70<br \/>\n  Allocated by task 91:<br \/>\n   hci_chan_create+0xe3\/0x350<br \/>\n   l2cap_conn_add.part.0+0x12\/0xa30<br \/>\n   l2cap_chan_connect+0x110d\/0x1b60<br \/>\n   l2cap_sock_connect+0x310\/0x530<br \/>\n  Freed by task 99:<br \/>\n   hci_chan_del+0x11f\/0x170<br \/>\n   l2cap_conn_del+0x4f1\/0x800<br \/>\n   l2cap_connect_cfm+0x88c\/0xd30<br \/>\n   hci_conn_failed+0x150\/0x250<br \/>\n   hci_abort_conn_sync+0x3e3\/0x800<br \/>\n   hci_cmd_sync_run+0x7e\/0xc0<br \/>\n   hci_abort_conn+0x105\/0x1f0<br \/>\n   disconnect_sync+0x157\/0x290<br \/>\n   hci_cmd_sync_work+0x13c\/0x290<\/p>\n<p>Hold the existing device mutex across channel selection and transmission<br \/>\nin both schedulers to serialize them with channel teardown. Keep timeout<br \/>\nhandling outside the critical sections because hci_link_tx_to() acquires<br \/>\nthe same mutex. This also permits the transmit path to sleep, unlike<br \/>\nextending the RCU read-side critical section across packet submission.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>Bluetooth: hci_core: Serialize ACL scheduling with channel deletion<\/p>\n<p>hci_chan_sent() selects a channel under RCU but drops the read<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41207","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41207","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41207"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41207"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41207"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}