CVE-2026-98736: Linux Kernel Bluetooth Use-After-Free

CVE-2026-98736 Overview

CVE-2026-98736 is a use-after-free vulnerability in the Linux kernel Bluetooth subsystem. The flaw resides in hci_enhanced_setup_sync() within hci_conn, which handles enhanced Synchronous Connection-Oriented (SCO) link setup. The function dereferences conn->parent without holding hci_dev_lock, allowing a concurrent receive workqueue to free the Asynchronous Connection-Less (ACL) parent object. KASAN instrumentation confirms a slab use-after-free on the parent's features[0][3] field. The upstream fix holds hci_dev_lock() across the codec switch and every call to find_next_esco_param().

Critical Impact
A race between SCO setup and ACL disconnect handling can trigger kernel memory corruption, enabling denial of service or potential local privilege escalation on systems with Bluetooth enabled.

Affected Products

Linux kernel versions prior to the fixed commits listed in the stable tree
Distributions shipping the Linux kernel Bluetooth stack (net/bluetooth/hci_conn.c)
Systems with Bluetooth hardware and the bluetooth kernel module loaded

Discovery Timeline

2026-10-18 - CVE-2026-98736 published to NVD
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-98736

Vulnerability Analysis

The vulnerability is a use-after-free [CWE-416] race condition in the Bluetooth HCI connection management code. hci_enhanced_setup_sync() executes on the request workqueue without the hci_dev_lock held by its caller when the setup was queued. The function performs a Continuously Variable Slope Delta (CVSD) capability check and calls find_next_esco_param(), both of which dereference conn->parent.

Concurrently, the receive workqueue can process a disconnect event via hci_disconn_complete_evt(), which acquires hci_dev_lock() and invokes hci_conn_del() on the ACL parent. This path unlinks the SCO child, drops the parent reference, clears child->parent, and ultimately releases the ACL parent through bt_link_release(), calling kfree() on the parent object. The reference held for the queued SCO child does not keep the ACL parent alive after unlinking.

Commit 42de40abe25d previously protected the child object stored in the queued context but did not address these parent accesses. KASAN output confirmed the read of size 1 at offset 71 into the freed parent corresponds to the features[0][3] byte accessed during the codec capability check.

Root Cause

The root cause is missing lock coverage. hci_enhanced_setup_sync() runs asynchronously after being queued, and its caller does not retain hci_dev_lock for the duration of the parent dereferences. The teardown path in hci_disconn_complete_evt() holds the lock correctly, so adding matching lock acquisition in the setup path serializes the two operations.

Attack Vector

An attacker with local Bluetooth access or the ability to initiate SCO connections via sco_sock_connect() can race connection setup against a disconnect event. Triggering the window requires precise timing between the request workqueue and the receive workqueue. Successful exploitation corrupts freed slab memory, leading to kernel crashes or, with heap manipulation, potential code execution in kernel context.

The vulnerability is described in prose because no public proof-of-concept exploit code is referenced in the advisory. Technical details are available in the upstream patch set referenced in the Kernel Patch Change 024e05f.

Detection Methods for CVE-2026-98736

Indicators of Compromise

Kernel oops or panic messages referencing hci_enhanced_setup_sync, hci_cmd_sync_work, or bt_link_release
KASAN reports of slab-use-after-free in the Bluetooth HCI code path
Unexpected Bluetooth stack crashes during SCO or eSCO audio connection establishment

Detection Strategies

Enable KASAN on test and staging kernels to surface slab use-after-free conditions in net/bluetooth/
Monitor dmesg and journald for stack traces containing hci_conn_del, hci_disconn_complete_evt, and hci_rx_work in close temporal proximity
Audit installed kernel versions against the fixed stable commits (024e05f, 1239ef0, 70b5585, 93a737e, cabd58d9)

Monitoring Recommendations

Collect kernel crash dumps centrally and correlate Bluetooth subsystem faults across endpoint fleets
Alert on repeated Bluetooth module faults on the same host, which may indicate attempted race exploitation
Track SCO connection attempts via audit framework rules on sco_sock_connect for high-value systems

How to Mitigate CVE-2026-98736

Immediate Actions Required

Apply the upstream Linux kernel patch set from the stable tree to all affected hosts
Where patching is deferred, disable the Bluetooth stack by unloading the bluetooth and related kernel modules on systems that do not require it
Restrict physical and local user access on systems that must retain Bluetooth functionality

Patch Information

The fix holds hci_dev_lock() across the codec switch and every call to find_next_esco_param(), releasing it on all selection errors. configure_datapath_sync() remains outside the critical section because it waits for HCI events. The upstream commits are available at Kernel Patch Change 1239ef0, Kernel Patch Change 70b5585, Kernel Patch Change 93a737e, and Kernel Patch Change cabd58d9. Rebuild and reboot affected systems after applying the patched kernel package from your distribution.

Workarounds

Blacklist the bluetooth, btusb, and related modules in /etc/modprobe.d/ on servers that do not require Bluetooth
Disable Bluetooth radios in BIOS/UEFI firmware on fixed-function endpoints
Prevent unprivileged users from creating SCO sockets via Linux capability restrictions or seccomp policies on untrusted workloads

bash

# Disable Bluetooth kernel modules until the patched kernel is installed
echo 'blacklist bluetooth' | sudo tee /etc/modprobe.d/disable-bluetooth.conf
echo 'blacklist btusb' | sudo tee -a /etc/modprobe.d/disable-bluetooth.conf
sudo systemctl stop bluetooth.service
sudo systemctl disable bluetooth.service
sudo rmmod btusb bluetooth 2>/dev/null || true