CVE-2026-98246

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci sync: Serialize local codec list cleanup

hci dev close sync() clears hdev->local codecs after releasing hdev->lock. Codec list additions and both traversals in sco sock getsockopt() use that lock, but the close path does not. A close and BT CODEC query can therefore interleave as follows:

hci dev close sync() sco sock getsockopt() hci dev lock() fetch codec entry hci codec list clear() kfree(entry) read entry->id

The reader then accesses an entry which the close path has freed. KASAN

BUG: KASAN: slab-use-after-free in sco sock getsockopt+0xfa0/0xfe0 Read of size 1 at addr ffff8881001c3450 Call Trace: sco sock getsockopt+0xfa0/0xfe0 do sock getsockopt+0x537/0x7b0 sys getsockopt+0xf2/0x170 Allocated by task 92: hci codec list add.isra.0+0x2c/0x440 hci read codec capabilities+0x224/0x590 hci read supported codecs+0x2c2/0x640 Freed by task 92: kfree+0x131/0x3c0 hci codec list clear+0xd8/0x160 hci dev close sync+0x92a/0xfa0

Take hdev->lock around the clear operation at its existing point in the close path. This makes the clear wait for active readers and prevents a new traversal until the list is empty without changing teardown ordering.