CVE-2026-98632

Name of the Vulnerable Software and Affected Versions Linux Kernel (affected versions not specified)

Description A use-after-free issue exists in the Bluetooth management component. In the send cancel() function, pending mesh tx objects are removed and freed. However, if a transmission was already queued via mesh next(), the hdev->cmd sync work list retains a raw pointer to the freed mesh tx. When hci cmd sync work processes this entry, it attempts to execute mesh send sync and the mesh send start complete callback using the invalid pointer.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.