CVE-2026-98737: Bluetooth: hci_sync: Fix inquiry cache use-after-free
Bluetooth: hcisync: Fix inquiry cache use-after-free
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.113 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.56 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.10 - Compensating control
In the Linux Bluetooth hci_sync inquiry-cache handling, hold hdev->lock across each cache lookup and all reads from the result; copy the remote address before unlocking so discovery cancellation does not retain a cache-entry pointer; release hdev->lock before sending synchronous HCI commands because their completion handlers may need the same lock.
Event History
Frequently Asked Questions
What conditions are required to trigger the race?
A synchronous create-connection or stop-discovery worker must look up an inquiry-cache entry while a concurrent HCIINQUIRY ioctl flushes that cache. The flush can free the entry after the lookup returns, and the worker can then access the freed entry while preparing a create-connection or remote-name-cancel command.
How can I tell whether this issue has occurred?
KASAN can report a slab use-after-free in hci_acl_create_conn_sync or hci_stop_discovery_sync, with hci_cmd_sync_work on the workqueue stack. The reported allocation path includes hci_inquiry_cache_update, while the free path includes hci_inquiry_cache_flush, hci_inquiry, and hci_sock_ioctl.