CVE-2026-98734

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_core: Serialize SCO and ISO scheduling with teardown

hci_low_sent() selects a connection under RCU but drops the read lock

before calculating its quota and returning it to the scheduler. The

connection is then used without lifetime protection by hci_sched_iso()

and hci_sched_sco().

After the TX worker drops the RCU read lock, hci_abort_conn_sync() on

hdev->req_workqueue can remove the connection from the hash, complete

synchronize_rcu(), purge its queues and release it. The TX worker on

hdev->workqueue can then access the freed connection in hci_quote_sent()

or while dequeuing packets and updating conn->sent.

KASAN reported:

BUG: KASAN: slab-use-after-free in hci_low_sent+0x730/0x840

Workqueue: hci0 hci_tx_work

Call Trace:

hci_low_sent+0x730/0x840

hci_sched_iso+0x25e/0x4d0

hci_tx_work+0x239/0xcb0

Allocated by task 93:

__hci_conn_add+0x16f/0x1b40

hci_bind_bis+0x782/0x17b0

hci_connect_bis+0xa0/0x510

iso_sock_connect+0x589/0x1050

Freed by task 88:

kfree+0x131/0x3c0

device_release+0xc8/0x240

kobject_put+0x14d/0x280

hci_conn_del+0x55a/0xe80

hci_disconnect_sync+0x156/0x180

hci_abort_conn_sync+0x3e7/0x940

hci_cmd_sync_work+0x13c/0x290

Hold hci_dev_lock() across connection selection and transmission in both

SCO and ISO scheduling, serializing them with connection teardown. This

also prevents queuing completion timestamps after the connection queues

have been purged. Extending RCU across transmission would be unsafe

because the transmit path can sleep. Keep the ISO timeout check outside

the mutex since hci_link_tx_to() takes it itself.

The preceding channel fix already holds this mutex in the ACL and LE

schedulers, which call the SCO scheduler between packets. Move the SCO

body to __hci_sched_sco(), assert that its caller holds the mutex, and

use it directly from these locked paths. Keep a locking hci_sched_sco()

wrapper for the direct calls from hci_tx_work(). This avoids recursively

acquiring the device mutex while preserving the scheduling order.

Remove the obsolete claim that connection removal disables TX.