UBUNTU-CVE-2026-98632: Use After Free
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: Dequeue pending meshsendsync entries on cancel In sendcancel(), pending meshtx objects are removed from the hdev->meshpending list and freed via meshsendcomplete(). However, if a mesh transmission was already queued onto hdev->cmdsyncworklist via meshnext(), the queued entry retains a raw pointer to meshtx. When hcicmdsyncwork later processes the entry, it attempts to execute meshsendsync and its destroy callback meshsendstartcomplete using the already freed meshtx pointer, leading to a use-after-free. Fix this by invoking hcicmdsyncdequeue() for meshsendsync on the target meshtx before completing it. If the entry is found and dequeued, its destroy callback will complete and free the object; otherwise, meshsendcomplete() is called directly. Additionally, ensure the transmission queue advances after cancellation or errors. In meshsendstartcomplete(), call meshnext() on error unless err is -ECANCELED, because hcicmdsyncdequeue() holds hdev->cmdsyncworklock and calling meshnext() synchronously would deadlock. Instead, advance the queue in sendcancel() once the lock is released and if no transmission is in progress.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In the Bluetooth mesh cancellation path, invoke hci_cmd_sync_dequeue() for mesh_send_sync on the target mesh_tx before completing it. In send_cancel(), advance the queue after releasing the lock when no transmission is in progress; in mesh_send_start_complete(), call mesh_next() on errors except -ECANCELED to avoid deadlocking while hci_cmd_sync_dequeue() holds hdev->cmd_sync_work_lock.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running one of the listed Ubuntu kernel packages are in scope: linux-riscv, linux-realtime, linux-azure, linux-gcp, linux-azure-fde, linux-gke, linux-hwe-edge, or linux-gkeop. The affected code is in the Linux kernel Bluetooth management path for mesh transmissions.
What conditions are needed to trigger the vulnerability?
An attacker needs local access and high privileges. The failure occurs when a pending Bluetooth mesh transmission is cancelled after its mesh_send_sync work item has already been queued, leaving queued work with a pointer to an object that has been freed.
How can I determine whether a system may be affected?
Check whether the system is running one of the listed Ubuntu kernel package variants and uses Bluetooth mesh transmission functionality. The provided data does not include fixed package versions, so version-based confirmation is not available here.