{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98733", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.367Z", "datePublished": "2026-10-18T15:47:11.210Z", "dateUpdated": "2026-10-30T12:39:09.881Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:39:09.881Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_core: Serialize fragmented ISO packet queueing\n\nThe fragmented path in hci_queue_iso() calls __skb_queue_tail() without\nholding conn->data_q.lock. The socket lock serializes senders, but the\ntransmit worker can concurrently remove packets from this queue using\nskb_dequeue().\n\nAfter an insertion saves the old tail pointer, hci_sched_iso() can dequeue\nthat packet and pass it to the driver. The driver can free the packet\nbefore the insertion resumes and writes to the old tail's next pointer,\ncausing a use-after-free. Concurrent updates can also corrupt the queue.\n\nKASAN reported:\n\n BUG: KASAN: slab-use-after-free in hci_send_iso+0xc7d/0xe10\n Call Trace:\n hci_send_iso+0xc7d/0xe10\n iso_sock_sendmsg+0x710/0x900\n __sys_sendto+0x34a/0x3a0\n\n Allocated by task 86:\n __alloc_skb+0xdd/0x820\n alloc_skb_with_frags+0x7e/0x770\n sock_alloc_send_pskb+0x67a/0x820\n bt_skb_sendmsg.constprop.0+0xc0/0x6c0\n iso_sock_sendmsg+0x44e/0x900\n\n Freed by task 90:\n kmem_cache_free+0xcb/0x3d0\n vhci_read+0x33f/0x4d0\n vfs_read+0x177/0xa20\n\nHold the queue lock across the entire fragment batch, as hci_queue_acl()\ndoes, to serialize insertion against dequeue while preserving fragment\nordering."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bluetooth/hci_core.c"], "versions": [{"version": "26afbd826ee326e63a334c37fd45e82e50a615ec", "lessThan": "e328b5823fa6b0b160d0922d6d68323e910d09a4", "status": "affected", "versionType": "git"}, {"version": "26afbd826ee326e63a334c37fd45e82e50a615ec", "lessThan": "545fa70f730eb648a610a2f4b2d270865f77b619", "status": "affected", "versionType": "git"}, {"version": "26afbd826ee326e63a334c37fd45e82e50a615ec", "lessThan": "d6d709981208567868c5c01ebd1bec5e5e7fdab0", "status": "affected", "versionType": "git"}, {"version": "26afbd826ee326e63a334c37fd45e82e50a615ec", "lessThan": "708cdd203d0bbcf9255fffb2e4c308d5b28851a7", "status": "affected", "versionType": "git"}, {"version": "26afbd826ee326e63a334c37fd45e82e50a615ec", "lessThan": "a7161730a3ab3f0a3896000db7ab0284683936e6", "status": "affected", "versionType": "git"}, {"version": "26afbd826ee326e63a334c37fd45e82e50a615ec", "lessThan": "1a572db43c057566771b485598ad2e66cb390821", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bluetooth/hci_core.c"], "versions": [{"version": "6.0", "status": "affected"}, {"version": "0", "lessThan": "6.0", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.113", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.56", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.10", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.12.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.18.56"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "7.2.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/e328b5823fa6b0b160d0922d6d68323e910d09a4"}, {"url": "https://git.kernel.org/stable/c/545fa70f730eb648a610a2f4b2d270865f77b619"}, {"url": "https://git.kernel.org/stable/c/d6d709981208567868c5c01ebd1bec5e5e7fdab0"}, {"url": "https://git.kernel.org/stable/c/708cdd203d0bbcf9255fffb2e4c308d5b28851a7"}, {"url": "https://git.kernel.org/stable/c/a7161730a3ab3f0a3896000db7ab0284683936e6"}, {"url": "https://git.kernel.org/stable/c/1a572db43c057566771b485598ad2e66cb390821"}], "title": "Bluetooth: hci_core: Serialize fragmented ISO packet queueing", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/bluetooth/hci_core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "e328b5823fa6b0b160d0922d6d68323e910d09a4", "status": "affected", "version": "26afbd826ee326e63a334c37fd45e82e50a615ec", "versionType": "git"}, {"lessThan": "545fa70f730eb648a610a2f4b2d270865f77b619", "status": "affected", "version": "26afbd826ee326e63a334c37fd45e82e50a615ec", "versionType": "git"}, {"lessThan": "d6d709981208567868c5c01ebd1bec5e5e7fdab0", "status": "affected", "version": "26afbd826ee326e63a334c37fd45e82e50a615ec", "versionType": "git"}, {"lessThan": "708cdd203d0bbcf9255fffb2e4c308d5b28851a7", "status": "affected", "version": "26afbd826ee326e63a334c37fd45e82e50a615ec", "versionType": "git"}, {"lessThan": "a7161730a3ab3f0a3896000db7ab0284683936e6", "status": "affected", "version": "26afbd826ee326e63a334c37fd45e82e50a615ec", "versionType": "git"}, {"lessThan": "1a572db43c057566771b485598ad2e66cb390821", "status": "affected", "version": "26afbd826ee326e63a334c37fd45e82e50a615ec", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/bluetooth/hci_core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.0"}, {"lessThan": "6.0", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.113", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.56", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_core: Serialize fragmented ISO packet queueing\n\nThe fragmented path in hci_queue_iso() calls __skb_queue_tail() without\nholding conn->data_q.lock. The socket lock serializes senders, but the\ntransmit worker can concurrently remove packets from this queue using\nskb_dequeue().\n\nAfter an insertion saves the old tail pointer, hci_sched_iso() can dequeue\nthat packet and pass it to the driver. The driver can free the packet\nbefore the insertion resumes and writes to the old tail's next pointer,\ncausing a use-after-free. Concurrent updates can also corrupt the queue.\n\nKASAN reported:\n\n BUG: KASAN: slab-use-after-free in hci_send_iso+0xc7d/0xe10\n Call Trace:\n hci_send_iso+0xc7d/0xe10\n iso_sock_sendmsg+0x710/0x900\n __sys_sendto+0x34a/0x3a0\n\n Allocated by task 86:\n __alloc_skb+0xdd/0x820\n alloc_skb_with_frags+0x7e/0x770\n sock_alloc_send_pskb+0x67a/0x820\n bt_skb_sendmsg.constprop.0+0xc0/0x6c0\n iso_sock_sendmsg+0x44e/0x900\n\n Freed by task 90:\n kmem_cache_free+0xcb/0x3d0\n vhci_read+0x33f/0x4d0\n vfs_read+0x177/0xa20\n\nHold the queue lock across the entire fragment batch, as hci_queue_acl()\ndoes, to serialize insertion against dequeue while preserving fragment\nordering."}], "id": "CVE-2026-98733", "lastModified": "2026-10-30T13:21:22.107", "metrics": {}, "published": "2026-10-18T16:17:26.900", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1a572db43c057566771b485598ad2e66cb390821"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/545fa70f730eb648a610a2f4b2d270865f77b619"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/708cdd203d0bbcf9255fffb2e4c308d5b28851a7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a7161730a3ab3f0a3896000db7ab0284683936e6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d6d709981208567868c5c01ebd1bec5e5e7fdab0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e328b5823fa6b0b160d0922d6d68323e910d09a4"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: kernel: Denial of Service via use-after-free in Bluetooth ISO packet queueing", "id": "2555106", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555106"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-416", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nBluetooth: hci_core: Serialize fragmented ISO packet queueing\nThe fragmented path in hci_queue_iso() calls __skb_queue_tail() without\nholding conn->data_q.lock. The socket lock serializes senders, but the\ntransmit worker can concurrently remove packets from this queue using\nskb_dequeue().\nAfter an insertion saves the old tail pointer, hci_sched_iso() can dequeue\nthat packet and pass it to the driver. The driver can free the packet\nbefore the insertion resumes and writes to the old tail's next pointer,\ncausing a use-after-free. Concurrent updates can also corrupt the queue.\nKASAN reported:\nBUG: KASAN: slab-use-after-free in hci_send_iso+0xc7d/0xe10\nCall Trace:\nhci_send_iso+0xc7d/0xe10\niso_sock_sendmsg+0x710/0x900\n__sys_sendto+0x34a/0x3a0\nAllocated by task 86:\n__alloc_skb+0xdd/0x820\nalloc_skb_with_frags+0x7e/0x770\nsock_alloc_send_pskb+0x67a/0x820\nbt_skb_sendmsg.constprop.0+0xc0/0x6c0\niso_sock_sendmsg+0x44e/0x900\nFreed by task 90:\nkmem_cache_free+0xcb/0x3d0\nvhci_read+0x33f/0x4d0\nvfs_read+0x177/0xa20\nHold the queue lock across the entire fragment batch, as hci_queue_acl()\ndoes, to serialize insertion against dequeue while preserving fragment\nordering.", "A flaw was found in the Linux kernel's Bluetooth subsystem. Inadequate synchronization when handling fragmented isochronous (ISO) data packets allows a race condition between packet queueing and transmission operations. A local user could exploit this flaw to trigger a use-after-free condition, leading to a system crash and Denial of Service (DoS)."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-98733", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}], "public_date": "2026-10-18T15:47:11Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98733\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98733\nhttps://git.kernel.org/stable/c/1a572db43c057566771b485598ad2e66cb390821\nhttps://git.kernel.org/stable/c/708cdd203d0bbcf9255fffb2e4c308d5b28851a7\nhttps://git.kernel.org/stable/c/a7161730a3ab3f0a3896000db7ab0284683936e6\nhttps://git.kernel.org/stable/c/d6d709981208567868c5c01ebd1bec5e5e7fdab0\nhttps://kernelcve.org/list/?q=CVE-2026-98733"], "statement": "A race in the Bluetooth HCI ISO fragmented transmit path allows hci_queue_iso to update the packet queue without holding its lock while the transmit worker can dequeue and release the previous tail SKB. If the driver frees that SKB before insertion resumes, __skb_queue_tail can write through the stale tail pointer and cause a slab use after free or corrupt the queue. A local process can reach the affected path through iso_sock_sendmsg when fragmented ISO packets are queued while transmission is active. For the CVSS the PR:L value is selected because local code execution and access to a Bluetooth ISO socket are required, while full administrative privileges are not clearly required by the affected send path. AC:H reflects the timing dependent race between packet insertion, dequeue, and driver release. The issue is not directly network reachable because a remote Bluetooth peer cannot by itself invoke the local sendmsg path based on the available evidence. Impact is at least a local denial of service through a kernel crash and may include confidentiality or integrity impact because the stale pointer is used for a write into freed slab memory. The paranoid score uses C:H I:H A:H because a confirmed write use after free can potentially support privilege escalation if object reuse and race timing become controllable, but that escalation path is not demonstrated.", "threat_severity": "Moderate"}