UBUNTU-CVE-2026-98734: Use After Free
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: Serialize SCO and ISO scheduling with teardown hcilowsent() selects a connection under RCU but drops the read lock before calculating its quota and returning it to the scheduler. The connection is then used without lifetime protection by hcischediso() and hcischedsco(). After the TX worker drops the RCU read lock, hciabortconnsync() on hdev->reqworkqueue can remove the connection from the hash, complete synchronizercu(), purge its queues and release it. The TX worker on hdev->workqueue can then access the freed connection in hciquotesent() or while dequeuing packets and updating conn->sent. KASAN reported: BUG: KASAN: slab-use-after-free in hcilowsent+0x730/0x840 Workqueue: hci0 hcitxwork Call Trace: hcilowsent+0x730/0x840 hcischediso+0x25e/0x4d0 hcitxwork+0x239/0xcb0 Allocated by task 93: hciconnadd+0x16f/0x1b40 hcibindbis+0x782/0x17b0 hciconnectbis+0xa0/0x510 isosockconnect+0x589/0x1050 Freed by task 88: kfree+0x131/0x3c0 devicerelease+0xc8/0x240 kobjectput+0x14d/0x280 hciconndel+0x55a/0xe80 hcidisconnectsync+0x156/0x180 hciabortconnsync+0x3e7/0x940 hcicmdsyncwork+0x13c/0x290 Hold hcidevlock() across connection selection and transmission in both SCO and ISO scheduling, serializing them with connection teardown. This also prevents queuing completion timestamps after the connection queues have been purged. Extending RCU across transmission would be unsafe because the transmit path can sleep. Keep the ISO timeout check outside the mutex since hcilinktxto() takes it itself. The preceding channel fix already holds this mutex in the ACL and LE schedulers, which call the SCO scheduler between packets. Move the SCO body to hcischedsco(), assert that its caller holds the mutex, and use it directly from these locked paths. Keep a locking hcischedsco() wrapper for the direct calls from hcitxwork(). This avoids recursively acquiring the device mutex while preserving the scheduling order. Remove the obsolete claim that connection removal disables TX.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Serialize SCO and ISO scheduling with connection teardown by holding hci_dev_lock() across connection selection and transmission; retain an hci_sched_sco() wrapper for direct hci_tx_work() calls, move the SCO body to __hci_sched_sco() with a caller-held-mutex assertion, call it directly from locked paths, and keep the ISO timeout check outside the mutex because hci_link_tx_to() acquires it.