CVE-2026-98734: Bluetooth: hci_core: Serialize SCO and ISO scheduling with teardown
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hcicore: Serialize SCO and ISO scheduling with teardown
hcilowsent() selects a connection under RCU but drops the read lock before calculating its quota and returning it to the scheduler. The connection is then used without lifetime protection by hcischediso() and hcischedsco().
After the TX worker drops the RCU read lock, hciabortconnsync() on hdev->reqworkqueue can remove the connection from the hash, complete synchronizercu(), purge its queues and release it. The TX worker on hdev->workqueue can then access the freed connection in hciquotesent() or while dequeuing packets and updating conn->sent.
KASAN reported:
BUG: KASAN: slab-use-after-free in hcilowsent+0x730/0x840 Workqueue: hci0 hcitxwork Call Trace: hcilowsent+0x730/0x840 hcischediso+0x25e/0x4d0 hcitxwork+0x239/0xcb0
Allocated by task 93: hciconnadd+0x16f/0x1b40 hcibindbis+0x782/0x17b0 hciconnectbis+0xa0/0x510 isosockconnect+0x589/0x1050
Freed by task 88: kfree+0x131/0x3c0 devicerelease+0xc8/0x240 kobjectput+0x14d/0x280 hciconndel+0x55a/0xe80 hcidisconnectsync+0x156/0x180 hciabortconnsync+0x3e7/0x940 hcicmdsyncwork+0x13c/0x290
Hold hcidevlock() across connection selection and transmission in both SCO and ISO scheduling, serializing them with connection teardown. This also prevents queuing completion timestamps after the connection queues have been purged. Extending RCU across transmission would be unsafe because the transmit path can sleep. Keep the ISO timeout check outside the mutex since hcilinktxto() takes it itself.
The preceding channel fix already holds this mutex in the ACL and LE schedulers, which call the SCO scheduler between packets. Move the SCO body to hcischedsco(), assert that its caller holds the mutex, and use it directly from these locked paths. Keep a locking hcischedsco() wrapper for the direct calls from hcitxwork(). This avoids recursively acquiring the device mutex while preserving the scheduling order.
Remove the obsolete claim that connection removal disables TX.
Affected Software
Event History
Frequently Asked Questions
What conditions are required for this issue to occur?
A Bluetooth SCO or ISO connection must be selected by the transmit scheduler while a concurrent teardown removes and releases that connection. The race involves the TX worker on hdev->workqueue and hci_abort_conn_sync() running on hdev->req_workqueue.
Which code paths are involved in the unsafe access?
The affected scheduling paths are hci_sched_iso() and hci_sched_sco(). They can use a connection after its RCU read-side protection has ended, including in hci_quote_sent(), packet dequeue handling, and updates to conn->sent.
How might an affected system be identified?
The supplied evidence is a KASAN slab use-after-free report with hci_low_sent() in the stack, reached through hci_sched_iso() and hci_tx_work. The freeing path includes hci_abort_conn_sync(), hci_disconnect_sync(), and hci_conn_del().