CVE-2026-98734

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci core: Serialize SCO and ISO scheduling with teardown

hci low sent() selects a connection under RCU but drops the read lock before calculating its quota and returning it to the scheduler. The connection is then used without lifetime protection by hci sched iso() and hci sched sco().

After the TX worker drops the RCU read lock, hci abort conn sync() on hdev->req workqueue can remove the connection from the hash, complete synchronize rcu(), purge its queues and release it. The TX worker on hdev->workqueue can then access the freed connection in hci quote sent() or while dequeuing packets and updating conn->sent.

KASAN reported:

BUG: KASAN: slab-use-after-free in hci low sent+0x730/0x840 Workqueue: hci0 hci tx work Call Trace: hci low sent+0x730/0x840 hci sched iso+0x25e/0x4d0 hci tx work+0x239/0xcb0

Allocated by task 93: hci conn add+0x16f/0x1b40 hci bind bis+0x782/0x17b0 hci connect bis+0xa0/0x510 iso sock connect+0x589/0x1050

Freed by task 88: kfree+0x131/0x3c0 device release+0xc8/0x240 kobject put+0x14d/0x280 hci conn del+0x55a/0xe80 hci disconnect sync+0x156/0x180 hci abort conn sync+0x3e7/0x940 hci cmd sync work+0x13c/0x290

Hold hci dev lock() across connection selection and transmission in both SCO and ISO scheduling, serializing them with connection teardown. This also prevents queuing completion timestamps after the connection queues have been purged. Extending RCU across transmission would be unsafe because the transmit path can sleep. Keep the ISO timeout check outside the mutex since hci link tx to() takes it itself.

The preceding channel fix already holds this mutex in the ACL and LE schedulers, which call the SCO scheduler between packets. Move the SCO body to hci sched sco(), assert that its caller holds the mutex, and use it directly from these locked paths. Keep a locking hci sched sco() wrapper for the direct calls from hci tx work(). This avoids recursively acquiring the device mutex while preserving the scheduling order.

Remove the obsolete claim that connection removal disables TX.