CVE-2026-99014

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci sync: Fix command skb lifetime during scan setup

During PA sync scan setup, hci le set ext scan param sync() gets the address used for the PA LINK lookup from hci sent cmd data(). The returned pointer borrows storage from sent cmd or req skb, without holding a reference to either skb.

The scan worker runs on req workqueue while hci cmd work() runs on the separate device workqueue. After the scan worker loads sent cmd, the command worker can free and replace it before hci sent cmd data() dereferences the skb. The command payload can also be freed between returning from the helper and comparing the address. The connection lookup's RCU critical section does not protect the command skb.

KASAN reported:

BUG: KASAN: slab-use-after-free in hci sent cmd data+0x27c/0x2f0 Workqueue: hci0 hci cmd sync work Call Trace: hci sent cmd data+0x27c/0x2f0 hci le set scan param sync+0x43a/0x850 hci passive scan sync+0xb09/0x1460 hci update passive scan sync+0x47c/0x6e0 hci le pa create sync+0x200/0xa70 hci cmd sync work+0x13c/0x290

Allocated by task 95: skb clone+0x13f/0x340 hci cmd work+0x2a9/0x7e0

Freed by task 95: kmem cache free+0xba/0x3a0 hci cmd work+0x29c/0x7e0

Use hdev->lock to serialize the address snapshot with sent cmd replacement. Protect req skb replacement and completion cleanup with the same lock because the helper falls back to that skb. Copy the address before releasing the lock and use the copy for the existing RCU-protected connection lookup. Release the mutex before sending or waiting for commands, preserving the lookup and completion ordering.