UBUNTU-CVE-2026-98736: Use After Free
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: Lock parent access during enhanced SCO setup Bluetooth: hciconn: Lock parent access during enhanced SCO setup hcienhancedsetupsync() runs on the request workqueue without the hcidevlock held by its caller when setup was queued. Its CVSD capability check and findnextescoparam() dereference conn->parent while the receive workqueue can unlink and release that parent. The following interleaving can cause a use-after-free: hcienhancedsetupsync() hcidisconncompleteevt() load conn->parent hcidevlock() hciconndel(ACL parent) unlink SCO child drop link's parent reference clear child->parent release ACL parent btlinkrelease() kfree(parent) hcidevunlock() read parent->features[0][3] The reference held for the queued SCO child does not keep its ACL parent alive after unlinking. Commit 42de40abe25d ("Bluetooth: hciconn: fix the SCO setup context lifetime") protects the child stored in the queued context, but leaves these parent accesses unprotected. With a 40 ms diagnostic delay after loading conn->parent, an instrumented kernel based on fd179f8a05be, which already contains 42de40abe25d, BUG: KASAN: slab-use-after-free in hcienhancedsetupsync+0xda5/0xdf0 Read of size 1 at addr ffff888102204047 by task kworker/u17:0/93 Call Trace: hcienhancedsetupsync+0xda5/0xdf0 hcicmdsyncwork+0x13c/0x290 processonework+0x6b4/0x10e0 Allocated by task 92: hciconnadd+0x304/0x1df0 hciconnectacl+0x349/0x3e0 hciconnectsco+0x3b/0x9a0 scosockconnect+0x475/0xca0 Freed by task 94: kfree+0x121/0x3c0 btlinkrelease+0x79/0xa0 devicerelease+0xc8/0x240 kobjectput+0x14d/0x280 hciconndel+0x524/0xe30 hcidisconncompleteevt+0x403/0x8c0 hcieventpacket+0x71b/0xb20 hcirxwork+0x293/0x730 The accessed address is 71 bytes into the freed ACL parent, at its features[0][3] byte; the queued SCO child is a different object. The diagnostic preserves the loaded parent across the delay, matching the unmodified compiled capability check, and does not change the parent references or teardown path. Hold hcidevlock() across the codec switch, including every call to findnextescoparam(), and release it on all selection errors. Keep configuredatapathsync() outside the critical section because it waits for HCI events. Preserve parameter selection and existing return values.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1069.74~22.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1073.82~22.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1071.78~22.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1073.81~22.04.1 - Upgrade
Upgrade
ubuntu/linux-ibm-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1069.70~22.04.1 - Upgrade
Upgrade
ubuntu/linux-lowlatency-hwe-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-149.149.1~22.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1067.71~22.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-149.149~22.04.2 - Upgrade
Upgrade
ubuntu/linux-realtime-6.8to a version that resolves this vulnerability.Fixed in 6.8.1-1064.65~22.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 6.8.0-149.149 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 6.8.0-1069.74 - Upgrade
Upgrade
ubuntu/linux-aws-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.18~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 6.8.0-1073.82 - Upgrade
Upgrade
ubuntu/linux-azure-fde-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1019.19~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 6.8.0-1073.81 - Upgrade
Upgrade
ubuntu/linux-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.19~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 6.8.0-1068.77 - Upgrade
Upgrade
ubuntu/linux-gkeopto a version that resolves this vulnerability.Fixed in 6.8.0-1053.57 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 6.8.0-1069.70 - Upgrade
Upgrade
ubuntu/linux-lowlatencyto a version that resolves this vulnerability.Fixed in 6.8.0-149.149.1 - Upgrade
Upgrade
ubuntu/linux-nvidiato a version that resolves this vulnerability.Fixed in 6.8.0-1067.70 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 6.8.0-1067.71 - Upgrade
Upgrade
ubuntu/linux-oracle-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1016.18~24.04.1 - Upgrade
Upgrade
ubuntu/linux-raspito a version that resolves this vulnerability.Fixed in 6.8.0-1068.72 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-43.43.1~24.04.2 - Upgrade
Upgrade
ubuntu/linux-vmwareto a version that resolves this vulnerability.Fixed in 6.8.0-1010.10 - Upgrade
Upgrade
ubuntu/linux-bluefieldto a version that resolves this vulnerability.Fixed in 6.8.0-1036.41 - Upgrade
Upgrade
ubuntu/linux-raspi-realtimeto a version that resolves this vulnerability.Fixed in 6.8.0-2056.58 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 6.8.1-1064.65 - Upgrade
Upgrade
ubuntu/linux-aws-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1069.74+fips1 - Upgrade
Upgrade
ubuntu/linux-azure-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1073.82+fips1 - Upgrade
Upgrade
ubuntu/linux-gcp-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1073.81+fips1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-43.43 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1017.18 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1020.21 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1019.19 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1017.19 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 7.0.0-1010.11 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1018.18 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1018.18 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-43.43.1 - Compensating control
In hci_enhanced_setup_sync(), hold hci_dev_lock() across the codec switch and every call to find_next_esco_param(), release the lock on all parameter-selection errors, and keep configure_datapath_sync() outside the critical section because it waits for HCI events.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The affected software listed is Ubuntu Linux kernel packages for riscv, realtime, azure, gcp, azure-fde, gke, hwe-edge, and gkeop. The vulnerable code is in the kernel Bluetooth connection handling path.
What conditions are needed to trigger the vulnerability?
Triggering requires a race between enhanced SCO setup running on the request workqueue and Bluetooth disconnect processing on the receive workqueue. The disconnect path must unlink and release an ACL parent connection while the SCO setup path is accessing that parent.
What is the potential impact?
The race can produce a use-after-free when the SCO setup code reads the released ACL parent connection's feature data. The provided severity vector indicates local access, low privileges, no user interaction, and high availability impact.
How can I determine whether a system is affected?
Check whether the running Ubuntu kernel package is one of the listed package families and whether it contains the upstream stable fix referenced as cabd58d9bb66d49d481f762ce986173db397435d. The provided data does not include fixed package versions.