CVE-2026-98733: Bluetooth: hci_core: Serialize fragmented ISO packet queueing
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hcicore: Serialize fragmented ISO packet queueing
The fragmented path in hciqueueiso() calls skbqueuetail() without holding conn->dataq.lock. The socket lock serializes senders, but the transmit worker can concurrently remove packets from this queue using skbdequeue().
After an insertion saves the old tail pointer, hcischediso() can dequeue that packet and pass it to the driver. The driver can free the packet before the insertion resumes and writes to the old tail's next pointer, causing a use-after-free. Concurrent updates can also corrupt the queue.
KASAN reported:
BUG: KASAN: slab-use-after-free in hcisendiso+0xc7d/0xe10 Call Trace: hcisendiso+0xc7d/0xe10 isosocksendmsg+0x710/0x900 syssendto+0x34a/0x3a0
Allocated by task 86: allocskb+0xdd/0x820 allocskbwithfrags+0x7e/0x770 sockallocsendpskb+0x67a/0x820 btskbsendmsg.constprop.0+0xc0/0x6c0 isosocksendmsg+0x44e/0x900
Freed by task 90: kmemcachefree+0xcb/0x3d0 vhciread+0x33f/0x4d0 vfsread+0x177/0xa20
Hold the queue lock across the entire fragment batch, as hciqueueacl() does, to serialize insertion against dequeue while preserving fragment ordering.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Hold conn->data_q.lock across the entire fragmented ISO packet insertion batch to serialize queue insertion against dequeue and preserve fragment ordering, as hci_queue_acl() does.