CVE-2026-98733 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_core: Serialize fragmented ISO packet queueing
The fragmented path in hci_queue_iso() calls __skb_queue_tail() without holding conn->data_q.lock. The socket lock serializes senders, but the transmit worker can concurrently remove packets from this queue using skb_dequeue().
After an insertion saves the old tail pointer, hci_sched_iso() can dequeue that packet and pass it to the driver. The driver can free the packet before the insertion resumes and writes to the old tail's next pointer, causing a use-after-free. Concurrent updates can also corrupt the queue.
KASAN reported:
BUG: KASAN: slab-use-after-free in hci_send_iso+0xc7d/0xe10 Call Trace: hci_send_iso+0xc7d/0xe10 iso_sock_sendmsg+0x710/0x900 __sys_sendto+0x34a/0x3a0
Allocated by task 86: __alloc_skb+0xdd/0x820 alloc_skb_with_frags+0x7e/0x770 sock_alloc_send_pskb+0x67a/0x820 bt_skb_sendmsg.constprop.0+0xc0/0x6c0 iso_sock_sendmsg+0x44e/0x900
Freed by task 90: kmem_cache_free+0xcb/0x3d0 vhci_read+0x33f/0x4d0 vfs_read+0x177/0xa20
Hold the queue lock across the entire fragment batch, as hci_queue_acl() does, to serialize insertion against dequeue while preserving fragment ordering.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/19/2026
The Linux kernel Bluetooth subsystem contains a critical concurrency flaw within the HCI core module that affects the handling of fragmented ISO packets. Specifically, the function hci_queue_iso performs operations on the connection data queue without acquiring the necessary synchronization lock, conn->data_q.lock. While the socket lock effectively serializes senders initiating new transmissions, it does not protect against concurrent access by the transmit worker thread. This worker is responsible for removing packets from the queue using skb_dequeue to pass them to the underlying driver for transmission. The absence of proper locking in the insertion path creates a race condition where multiple threads can manipulate the linked list structure simultaneously without mutual exclusion.
The technical nature of this vulnerability centers on a use-after-free error resulting from unsynchronized modifications to the packet queue's tail pointer. When hci_queue_iso inserts a fragmented packet, it saves the old tail pointer before updating the queue. During this window, if the transmit worker dequeues and processes that same packet, the driver may free the associated memory buffer. If the insertion operation then resumes and attempts to write to the next pointer of the now-freed tail node, it accesses invalid memory, triggering a kernel panic or undefined behavior as reported by KASAN. This scenario is exacerbated by concurrent updates which can also corrupt the queue structure itself, leading to potential denial of service conditions where the Bluetooth stack becomes unstable or unresponsive.
The operational impact of this vulnerability allows for local privilege escalation if an attacker can trigger the race condition through crafted ISO socket operations. By carefully timing packet transmissions and forcing the transmit worker to process packets concurrently with fragmented insertions, a malicious user space application could exploit the use-after-free state to execute arbitrary code within the kernel context. The KASAN trace confirms that memory allocated via sock_alloc_send_pskb is freed by vhci_read before being accessed in hci_send_iso, illustrating how standard Bluetooth virtual interface operations can be weaponized to corrupt kernel heap structures. This represents a significant security risk for systems relying on Bluetooth Low Energy or ISO socket communications, particularly those exposed to untrusted local users.
To mitigate this vulnerability, the Linux kernel developers have implemented a fix that enforces strict serialization of fragmented packet queueing. The solution involves holding the conn->data_q.lock across the entire fragment batch insertion process in hci_queue_iso, mirroring the approach already used by hci_queue_acl for ACL packets. This ensures that insertions are atomic with respect to dequeuing operations performed by the transmit worker. By preserving this locking mechanism, the kernel prevents concurrent modifications to the queue's linked list pointers, thereby eliminating the race condition that leads to use-after-free errors and structural corruption. System administrators should apply the latest kernel updates containing this patch to restore secure operation of the Bluetooth stack.
From a classification perspective, this vulnerability aligns with CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization, as it involves multiple threads accessing shared data structures without adequate locking mechanisms. Additionally, the exploitation technique relates to memory corruption vulnerabilities often categorized under CWE-416: Use After Free. In terms of attack patterns, this scenario reflects behaviors associated with MITRE ATT&CK techniques involving resource manipulation and potential privilege escalation through kernel-level exploits. The fix demonstrates best practices in systems programming by ensuring that critical sections protecting shared state are properly guarded to maintain data integrity and prevent security breaches arising from timing dependencies.