CVE-2026-98733

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci core: Serialize fragmented ISO packet queueing

The fragmented path in hci queue iso() calls skb queue tail() without holding conn->data q.lock. The socket lock serializes senders, but the transmit worker can concurrently remove packets from this queue using skb dequeue().

After an insertion saves the old tail pointer, hci sched iso() can dequeue that packet and pass it to the driver. The driver can free the packet before the insertion resumes and writes to the old tail's next pointer, causing a use-after-free. Concurrent updates can also corrupt the queue.

KASAN reported:

BUG: KASAN: slab-use-after-free in hci send iso+0xc7d/0xe10 Call Trace: hci send iso+0xc7d/0xe10 iso sock sendmsg+0x710/0x900 sys sendto+0x34a/0x3a0

Allocated by task 86: alloc skb+0xdd/0x820 alloc skb with frags+0x7e/0x770 sock alloc send pskb+0x67a/0x820 bt skb sendmsg.constprop.0+0xc0/0x6c0 iso sock sendmsg+0x44e/0x900

Freed by task 90: kmem cache free+0xcb/0x3d0 vhci read+0x33f/0x4d0 vfs read+0x177/0xa20

Hold the queue lock across the entire fragment batch, as hci queue acl() does, to serialize insertion against dequeue while preserving fragment ordering.