{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98632", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.361Z", "datePublished": "2026-10-18T15:19:56.287Z", "dateUpdated": "2026-10-19T09:23:00.460Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:23:00.460Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel\n\nIn send_cancel(), pending mesh_tx objects are removed from the\nhdev->mesh_pending list and freed via mesh_send_complete(). However, if\na mesh transmission was already queued onto hdev->cmd_sync_work_list via\nmesh_next(), the queued entry retains a raw pointer to mesh_tx.\n\nWhen hci_cmd_sync_work later processes the entry, it attempts to execute\nmesh_send_sync and its destroy callback mesh_send_start_complete using\nthe already freed mesh_tx pointer, leading to a use-after-free.\n\nFix this by invoking hci_cmd_sync_dequeue() for mesh_send_sync on the\ntarget mesh_tx before completing it. If the entry is found and dequeued,\nits destroy callback will complete and free the object; otherwise,\nmesh_send_complete() is called directly.\n\nAdditionally, ensure the transmission queue advances after cancellation\nor errors. In mesh_send_start_complete(), call mesh_next() on error\nunless err is -ECANCELED, because hci_cmd_sync_dequeue() holds\nhdev->cmd_sync_work_lock and calling mesh_next() synchronously would\ndeadlock. Instead, advance the queue in send_cancel() once the lock is\nreleased and if no transmission is in progress."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bluetooth/mgmt.c"], "versions": [{"version": "b338d91703fae6f6afd67f3f75caa3b8f36ddef3", "lessThan": "f84e52829021d00bca8e067302f597c71af1f71a", "status": "affected", "versionType": "git"}, {"version": "b338d91703fae6f6afd67f3f75caa3b8f36ddef3", "lessThan": "718a8ffa180d469f99ad4f746f00cafd39456415", "status": "affected", "versionType": "git"}, {"version": "b338d91703fae6f6afd67f3f75caa3b8f36ddef3", "lessThan": "084be90948632a5a358821e687b11a14445aae76", "status": "affected", "versionType": "git"}, {"version": "b338d91703fae6f6afd67f3f75caa3b8f36ddef3", "lessThan": "2189a219397d8e73808a67c4aade837b635705da", "status": "affected", "versionType": "git"}, {"version": "b338d91703fae6f6afd67f3f75caa3b8f36ddef3", "lessThan": "03ced4687fb79286be7fdee0fc58d2c74de3e7bb", "status": "affected", "versionType": "git"}, {"version": "b338d91703fae6f6afd67f3f75caa3b8f36ddef3", "lessThan": "71af682ba4692c2ed9ace4c3d4ca462ae368c029", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bluetooth/mgmt.c"], "versions": [{"version": "6.1", "status": "affected"}, {"version": "0", "lessThan": "6.1", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.55", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.9", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.18.55"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "7.2.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/f84e52829021d00bca8e067302f597c71af1f71a"}, {"url": "https://git.kernel.org/stable/c/718a8ffa180d469f99ad4f746f00cafd39456415"}, {"url": "https://git.kernel.org/stable/c/084be90948632a5a358821e687b11a14445aae76"}, {"url": "https://git.kernel.org/stable/c/2189a219397d8e73808a67c4aade837b635705da"}, {"url": "https://git.kernel.org/stable/c/03ced4687fb79286be7fdee0fc58d2c74de3e7bb"}, {"url": "https://git.kernel.org/stable/c/71af682ba4692c2ed9ace4c3d4ca462ae368c029"}], "title": "Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/bluetooth/mgmt.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "f84e52829021d00bca8e067302f597c71af1f71a", "status": "affected", "version": "b338d91703fae6f6afd67f3f75caa3b8f36ddef3", "versionType": "git"}, {"lessThan": "718a8ffa180d469f99ad4f746f00cafd39456415", "status": "affected", "version": "b338d91703fae6f6afd67f3f75caa3b8f36ddef3", "versionType": "git"}, {"lessThan": "084be90948632a5a358821e687b11a14445aae76", "status": "affected", "version": "b338d91703fae6f6afd67f3f75caa3b8f36ddef3", "versionType": "git"}, {"lessThan": "2189a219397d8e73808a67c4aade837b635705da", "status": "affected", "version": "b338d91703fae6f6afd67f3f75caa3b8f36ddef3", "versionType": "git"}, {"lessThan": "03ced4687fb79286be7fdee0fc58d2c74de3e7bb", "status": "affected", "version": "b338d91703fae6f6afd67f3f75caa3b8f36ddef3", "versionType": "git"}, {"lessThan": "71af682ba4692c2ed9ace4c3d4ca462ae368c029", "status": "affected", "version": "b338d91703fae6f6afd67f3f75caa3b8f36ddef3", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/bluetooth/mgmt.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.1"}, {"lessThan": "6.1", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.112", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.55", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel\n\nIn send_cancel(), pending mesh_tx objects are removed from the\nhdev->mesh_pending list and freed via mesh_send_complete(). However, if\na mesh transmission was already queued onto hdev->cmd_sync_work_list via\nmesh_next(), the queued entry retains a raw pointer to mesh_tx.\n\nWhen hci_cmd_sync_work later processes the entry, it attempts to execute\nmesh_send_sync and its destroy callback mesh_send_start_complete using\nthe already freed mesh_tx pointer, leading to a use-after-free.\n\nFix this by invoking hci_cmd_sync_dequeue() for mesh_send_sync on the\ntarget mesh_tx before completing it. If the entry is found and dequeued,\nits destroy callback will complete and free the object; otherwise,\nmesh_send_complete() is called directly.\n\nAdditionally, ensure the transmission queue advances after cancellation\nor errors. In mesh_send_start_complete(), call mesh_next() on error\nunless err is -ECANCELED, because hci_cmd_sync_dequeue() holds\nhdev->cmd_sync_work_lock and calling mesh_next() synchronously would\ndeadlock. Instead, advance the queue in send_cancel() once the lock is\nreleased and if no transmission is in progress."}], "id": "CVE-2026-98632", "lastModified": "2026-10-19T10:19:27.457", "metrics": {}, "published": "2026-10-18T16:17:16.297", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/03ced4687fb79286be7fdee0fc58d2c74de3e7bb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/084be90948632a5a358821e687b11a14445aae76"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2189a219397d8e73808a67c4aade837b635705da"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/718a8ffa180d469f99ad4f746f00cafd39456415"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/71af682ba4692c2ed9ace4c3d4ca462ae368c029"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f84e52829021d00bca8e067302f597c71af1f71a"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel", "id": "2555010", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555010"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nBluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel\nIn send_cancel(), pending mesh_tx objects are removed from the\nhdev->mesh_pending list and freed via mesh_send_complete(). However, if\na mesh transmission was already queued onto hdev->cmd_sync_work_list via\nmesh_next(), the queued entry retains a raw pointer to mesh_tx.\nWhen hci_cmd_sync_work later processes the entry, it attempts to execute\nmesh_send_sync and its destroy callback mesh_send_start_complete using\nthe already freed mesh_tx pointer, leading to a use-after-free.\nFix this by invoking hci_cmd_sync_dequeue() for mesh_send_sync on the\ntarget mesh_tx before completing it. If the entry is found and dequeued,\nits destroy callback will complete and free the object; otherwise,\nmesh_send_complete() is called directly.\nAdditionally, ensure the transmission queue advances after cancellation\nor errors. In mesh_send_start_complete(), call mesh_next() on error\nunless err is -ECANCELED, because hci_cmd_sync_dequeue() holds\nhdev->cmd_sync_work_lock and calling mesh_next() synchronously would\ndeadlock. Instead, advance the queue in send_cancel() once the lock is\nreleased and if no transmission is in progress.", "A flaw was found in the Linux kernel's Bluetooth subsystem. A local attacker can trigger a use-after-free condition by cancelling a pending Bluetooth mesh transmission while it remains queued for processing. When the system later attempts to handle the queued transmission using the already freed object, memory corruption occurs, which can lead to a Denial of Service (DoS) through a system crash or potential privilege escalation."], "name": "CVE-2026-98632", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98632\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98632\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98632.mbox"], "threat_severity": "Moderate"}