CVE-2026-98736: Bluetooth: hci_conn: Lock parent access during enhanced SCO setup
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hciconn: Lock parent access during enhanced SCO setup
Bluetooth: hciconn: Lock parent access during enhanced SCO setup
hcienhancedsetupsync() runs on the request workqueue without the hcidevlock held by its caller when setup was queued. Its CVSD capability check and findnextescoparam() dereference conn->parent while the receive workqueue can unlink and release that parent.
The following interleaving can cause a use-after-free:
hcienhancedsetupsync() hcidisconncompleteevt() load conn->parent hcidevlock() hciconndel(ACL parent) unlink SCO child drop link's parent reference clear child->parent release ACL parent btlinkrelease() kfree(parent) hcidevunlock() read parent->features[0][3]
The reference held for the queued SCO child does not keep its ACL parent alive after unlinking. Commit 42de40abe25d ("Bluetooth: hciconn: fix the SCO setup context lifetime") protects the child stored in the queued context, but leaves these parent accesses unprotected.
With a 40 ms diagnostic delay after loading conn->parent, an instrumented kernel based on fd179f8a05be, which already contains 42de40abe25d,
BUG: KASAN: slab-use-after-free in hcienhancedsetupsync+0xda5/0xdf0 Read of size 1 at addr ffff888102204047 by task kworker/u17:0/93 Call Trace: hcienhancedsetupsync+0xda5/0xdf0 hcicmdsyncwork+0x13c/0x290 processonework+0x6b4/0x10e0
Allocated by task 92: hciconnadd+0x304/0x1df0 hciconnectacl+0x349/0x3e0 hciconnectsco+0x3b/0x9a0 scosockconnect+0x475/0xca0
Freed by task 94: kfree+0x121/0x3c0 btlinkrelease+0x79/0xa0 devicerelease+0xc8/0x240 kobjectput+0x14d/0x280 hciconndel+0x524/0xe30 hcidisconncompleteevt+0x403/0x8c0 hcieventpacket+0x71b/0xb20 hcirxwork+0x293/0x730
The accessed address is 71 bytes into the freed ACL parent, at its features[0][3] byte; the queued SCO child is a different object. The diagnostic preserves the loaded parent across the delay, matching the unmodified compiled capability check, and does not change the parent references or teardown path.
Hold hcidevlock() across the codec switch, including every call to findnextescoparam(), and release it on all selection errors. Keep configuredatapathsync() outside the critical section because it waits for HCI events. Preserve parameter selection and existing return values.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In hci_enhanced_setup_sync(), hold hci_dev_lock across the codec switch and every call to configure_datapath_sync(), including while waiting for HCI events, so conn->parent accesses are protected from concurrent SCO unlink and ACL-parent teardown.
- Compensating control
Preserve the ACL parent reference while performing the capability check and find_next_esco_param(); release that reference on every parameter-selection error, and clear child->parent when unlinking the SCO child before dropping the parent reference.