# CVE-2026-98734: Bluetooth: hci_core: Serialize SCO and ISO scheduling with teardown

CVE-2026-98734 is fixed in 2 products on 1 platform, first by DEBIAN-CVE-2026-98734, released October 19, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2026-98734
- Priority: High
- CVSS: 7.5 (Important)
- EPSS: 0.0017
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Oct 18, 2026
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-98734

## Description

In the Linux kernel, the following vulnerability has been resolved:  Bluetooth: hci_core: Serialize SCO and ISO scheduling with teardown  hci_low_sent() selects a connection under RCU but drops the read lock before calculating its quota and returning it to the scheduler. The connection is then used without lifetime protection by hci_sched_iso() and hci_sched_sco().  After the TX worker drops the RCU read lock, hci_abort_conn_sync() on hdev->req_workqueue can remove the connection from the hash, complete synchronize_rcu(), purge its queues and release it. The TX worker on hdev->workqueue can then access the freed connection in hci_quote_sent() or while dequeuing packets and updating conn->sent.  KASAN reported:    BUG: KASAN: slab-use-after-free in hci_low_sent+0x730/0x840   Workqueue: hci0 hci_tx_work   Call Trace:    hci_low_sent+0x730/0x840    hci_sched_iso+0x25e/0x4d0    hci_tx_work+0x239/0xcb0    Allocated by task 93:    __hci_conn_add+0x16f/0x1b40    hci_bind_bis+0x782/0x17b0    hci_connect_bis+0xa0/0x510    iso_sock_connect+0x589/0x1050    Freed by task 88:    kfree+0x131/0x3c0    device_release+0xc8/0x240    kobject_put+0x14d/0x280    hci_conn_del+0x55a/0xe80    hci_disconnect_sync+0x156/0x180    hci_abort_conn_sync+0x3e7/0x940    hci_cmd_sync_work+0x13c/0x290  Hold hci_dev_lock() across connection selection and transmission in both SCO and ISO scheduling, serializing them with connection teardown. This also prevents queuing completion timestamps after the connection queues have been purged. Extending RCU across transmission would be unsafe because the transmit path can sleep. Keep the ISO timeout check outside the mutex since hci_link_tx_to() takes it itself.  The preceding channel fix already holds this mutex in the ACL and LE schedulers, which call the SCO scheduler between packets. Move the SCO body to __hci_sched_sco(), assert that its caller holds the mutex, and use it directly from these locked paths. Keep a locking hci_sched_sco() wrapper for the direct calls from hci_tx_work(). This avoids recursively acquiring the device mutex while preserving the scheduling order.  Remove the obsolete claim that connection removal disables TX.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 13.5 (trixie) | 6.12.113-1 | [DEBIAN-CVE-2026-98734](https://patchblox.com/security/data/fix/linux/debian-cve-2026-98734.md) | Oct 19, 2026 |
| Linux | linux Debian 14 | 7.2.10-1 | [DEBIAN-CVE-2026-98734](https://patchblox.com/security/data/fix/linux/debian-cve-2026-98734.md) | Oct 19, 2026 |
| Linux | linux-6.12 Debian 12.15 (bookworm) | 6.12.113-1~deb12u1 | [DEBIAN-CVE-2026-98734](https://patchblox.com/security/data/fix/linux/debian-cve-2026-98734.md) | Oct 19, 2026 |

---

Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.