CVE-2026-99014: Bluetooth: hci_sync: Fix command skb lifetime during scan setup

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hcisync: Fix command skb lifetime during scan setup

During PA sync scan setup, hcilesetextscanparamsync() gets the address used for the PALINK lookup from hcisentcmddata(). The returned pointer borrows storage from sentcmd or reqskb, without holding a reference to either skb.

The scan worker runs on reqworkqueue while hcicmdwork() runs on the separate device workqueue. After the scan worker loads sentcmd, the command worker can free and replace it before hcisentcmddata() dereferences the skb. The command payload can also be freed between returning from the helper and comparing the address. The connection lookup's RCU critical section does not protect the command skb.

KASAN reported:

BUG: KASAN: slab-use-after-free in hcisentcmddata+0x27c/0x2f0 Workqueue: hci0 hcicmdsyncwork Call Trace: hcisentcmddata+0x27c/0x2f0 hcilesetscanparamsync+0x43a/0x850 hcipassivescansync+0xb09/0x1460 hciupdatepassivescansync+0x47c/0x6e0 hcilepacreatesync+0x200/0xa70 hcicmdsyncwork+0x13c/0x290

Allocated by task 95: skbclone+0x13f/0x340 hcicmdwork+0x2a9/0x7e0

Freed by task 95: kmemcachefree+0xba/0x3a0 hcicmdwork+0x29c/0x7e0

Use hdev->lock to serialize the address snapshot with sentcmd replacement. Protect reqskb replacement and completion cleanup with the same lock because the helper falls back to that skb. Copy the address before releasing the lock and use the copy for the existing RCU-protected connection lookup. Release the mutex before sending or waiting for commands, preserving the lookup and completion ordering.