CVE-2026-98733: Bluetooth: hci_core: Serialize fragmented ISO packet queueing
Bluetooth: hcicore: Serialize fragmented ISO packet queueing
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.113-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.10-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.113 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.56 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.10 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Configuration
Modify the fragmented path in hci_queue_iso() to hold conn->data_q.lock across the entire fragment batch, as hci_queue_acl() does, to serialize insertion against dequeue while preserving fragment ordering.
Linux kernel Bluetooth hci_core conn->data_q.lock = hold across the entire fragment batch
Event History
Frequently Asked Questions
What conditions are required to trigger this issue?
The race requires fragmented ISO packets to be queued while the transmit worker concurrently dequeues packets from the same connection data queue. The vulnerable path is hci_queue_iso(), where insertion was not serialized against skb_dequeue().
What is the likely impact if the race occurs?
A dequeued packet can be freed by the driver while queue insertion still holds and later writes through its former tail pointer. This produces a use-after-free and can corrupt the packet queue.
How is the issue fixed?
The fix holds conn->data_q.lock across the complete fragmented ISO packet batch. This serializes queue insertion with packet removal by the transmit worker.