{
  "cveId": "CVE-2026-98736",
  "url": "https://patchblox.com/security/cve/CVE-2026-98736",
  "summary": "CVE-2026-98736 is fixed in 12 products on 1 platform, first by DEBIAN-CVE-2026-98736, released October 19, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "Bluetooth: hci_conn: Lock parent access during enhanced SCO setup",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  Bluetooth: hci_conn: Lock parent access during enhanced SCO setup  Bluetooth: hci_conn: Lock parent access during enhanced SCO setup  hci_enhanced_setup_sync() runs on the request workqueue without the hci_dev_lock held by its caller when setup was queued. Its CVSD capability check and find_next_esco_param() dereference conn-\u003Eparent while the receive workqueue can unlink and release that parent.  The following interleaving can cause a use-after-free:    hci_enhanced_setup_sync()       hci_disconn_complete_evt()   load conn-\u003Eparent                                  hci_dev_lock()                                  hci_conn_del(ACL parent)                                    unlink SCO child                                    drop link\u0027s parent reference                                    clear child-\u003Eparent                                    release ACL parent                                      bt_link_release()                                        kfree(parent)                                  hci_dev_unlock()   read parent-\u003Efeatures[0][3]  The reference held for the queued SCO child does not keep its ACL parent alive after unlinking. Commit 42de40abe25d (\u0022Bluetooth: hci_conn: fix the SCO setup context lifetime\u0022) protects the child stored in the queued context, but leaves these parent accesses unprotected.  With a 40 ms diagnostic delay after loading conn-\u003Eparent, an instrumented kernel based on fd179f8a05be, which already contains 42de40abe25d,    BUG: KASAN: slab-use-after-free in hci_enhanced_setup_sync\u002B0xda5/0xdf0   Read of size 1 at addr ffff888102204047 by task kworker/u17:0/93   Call Trace:    hci_enhanced_setup_sync\u002B0xda5/0xdf0    hci_cmd_sync_work\u002B0x13c/0x290    process_one_work\u002B0x6b4/0x10e0    Allocated by task 92:    __hci_conn_add\u002B0x304/0x1df0    hci_connect_acl\u002B0x349/0x3e0    hci_connect_sco\u002B0x3b/0x9a0    sco_sock_connect\u002B0x475/0xca0    Freed by task 94:    kfree\u002B0x121/0x3c0    bt_link_release\u002B0x79/0xa0    device_release\u002B0xc8/0x240    kobject_put\u002B0x14d/0x280    hci_conn_del\u002B0x524/0xe30    hci_disconn_complete_evt\u002B0x403/0x8c0    hci_event_packet\u002B0x71b/0xb20    hci_rx_work\u002B0x293/0x730  The accessed address is 71 bytes into the freed ACL parent, at its features[0][3] byte; the queued SCO child is a different object. The diagnostic preserves the loaded parent across the delay, matching the unmodified compiled capability check, and does not change the parent references or teardown path.  Hold hci_dev_lock() across the codec switch, including every call to find_next_esco_param(), and release it on all selection errors. Keep configure_datapath_sync() outside the critical section because it waits for HCI events. Preserve parameter selection and existing return values.",
  "published": "2026-10-18T16:17:27Z",
  "severity": "Important",
  "cvss": 7.1,
  "epss": 0.00172,
  "epssPercentile": 0.06672,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-98736",
  "fixes": [
    {
      "platform": "linux",
      "product": "kernel-64kb",
      "release": "sles 15.7",
      "fixedVersion": "6.4.0-150700.53.90.1",
      "fix": "SUSE-SU-2026:5091-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1",
      "released": "2026-11-07T00:43:02Z"
    },
    {
      "platform": "linux",
      "product": "kernel-azure",
      "release": "sles 15.7",
      "fixedVersion": "6.4.0-150700.53.90.1",
      "fix": "SUSE-SU-2026:5091-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1",
      "released": "2026-11-07T00:43:02Z"
    },
    {
      "platform": "linux",
      "product": "kernel-default",
      "release": "sles 15.7",
      "fixedVersion": "6.4.0-150700.53.90.1",
      "fix": "SUSE-SU-2026:5091-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1",
      "released": "2026-11-07T00:43:02Z"
    },
    {
      "platform": "linux",
      "product": "kernel-default-base",
      "release": "sles 15.7",
      "fixedVersion": "6.4.0-150700.53.90.1.150700.17.51.1",
      "fix": "SUSE-SU-2026:5091-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1",
      "released": "2026-11-07T00:43:02Z"
    },
    {
      "platform": "linux",
      "product": "kernel-docs",
      "release": "sles 15.7",
      "fixedVersion": "6.4.0-150700.53.90.1",
      "fix": "SUSE-SU-2026:5091-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1",
      "released": "2026-11-07T00:43:02Z"
    },
    {
      "platform": "linux",
      "product": "kernel-livepatch-SLE15-SP7_Update_24",
      "release": "sles 15.7",
      "fixedVersion": "1-150700.15.3.1",
      "fix": "SUSE-SU-2026:5091-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1",
      "released": "2026-11-07T00:43:02Z"
    },
    {
      "platform": "linux",
      "product": "kernel-obs-build",
      "release": "sles 15.7",
      "fixedVersion": "6.4.0-150700.53.90.1",
      "fix": "SUSE-SU-2026:5091-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1",
      "released": "2026-11-07T00:43:02Z"
    },
    {
      "platform": "linux",
      "product": "kernel-source",
      "release": "sles 15.7",
      "fixedVersion": "6.4.0-150700.53.90.1",
      "fix": "SUSE-SU-2026:5091-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1",
      "released": "2026-11-07T00:43:02Z"
    },
    {
      "platform": "linux",
      "product": "kernel-syms",
      "release": "sles 15.7",
      "fixedVersion": "6.4.0-150700.53.90.1",
      "fix": "SUSE-SU-2026:5091-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1",
      "released": "2026-11-07T00:43:02Z"
    },
    {
      "platform": "linux",
      "product": "kernel-zfcpdump",
      "release": "sles 15.7",
      "fixedVersion": "6.4.0-150700.53.90.1",
      "fix": "SUSE-SU-2026:5091-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1",
      "released": "2026-11-07T00:43:02Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.12.113-1",
      "fix": "DEBIAN-CVE-2026-98736",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-98736",
      "released": "2026-10-19T16:27:52Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.2.10-1",
      "fix": "DEBIAN-CVE-2026-98736",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-98736",
      "released": "2026-10-19T16:27:52Z"
    },
    {
      "platform": "linux",
      "product": "linux-6.12",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.12.113-1~deb12u1",
      "fix": "DEBIAN-CVE-2026-98736",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-98736",
      "released": "2026-10-19T16:27:52Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}