VulnerabilityPublished 18 Oct 2026

CVE-2026-98736: Linux kernel · Bluetooth: hci_conn: Lock parent access during enhanced SCO setup

Source GCVE Database

Authoritative record:CVE-2026-98736

Not known to be exploited · fixed in cabd58d9bb66d49d481f762ce986173db397435d : patch Linux kernel soon.

Data as of 26 Oct 2026, 13:47 UTC

Severity

High

Rated by Threat Radar · CVSS not yet scored by NVD

EPSS: 0.1% chance of exploitation in 30 days – higher than 5% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in cabd58d9bb66d49d481f762ce986173db397435d, 1239ef0fa809b5952fca679db3faa3e1c00e1dac, 93a737e4e042f59673cd580d35214f278d7b757d +2

Exploitation evidence

Disclosed: evidence found.
CVE published 18 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-jxf9-629p-pmqw

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ e07a06b4eb417f5271d33ce2240e93c62d98b7b4, < cabd58d9bb66d49d481f762ce986173db397435d	Fixed in cabd58d9bb66d49d481f762ce986173db397435d
LinuxLinux	Affected ≥ e07a06b4eb417f5271d33ce2240e93c62d98b7b4, < 1239ef0fa809b5952fca679db3faa3e1c00e1dac	Fixed in 1239ef0fa809b5952fca679db3faa3e1c00e1dac
LinuxLinux	Affected ≥ e07a06b4eb417f5271d33ce2240e93c62d98b7b4, < 93a737e4e042f59673cd580d35214f278d7b757d	Fixed in 93a737e4e042f59673cd580d35214f278d7b757d
LinuxLinux	Affected ≥ e07a06b4eb417f5271d33ce2240e93c62d98b7b4, < 70b55855eecb428d446344d827bda8725ce8b312	Fixed in 70b55855eecb428d446344d827bda8725ce8b312
LinuxLinux	Affected ≥ e07a06b4eb417f5271d33ce2240e93c62d98b7b4, < 024e05f73a4c1263d031614bc36700ec135eecb4	Fixed in 024e05f73a4c1263d031614bc36700ec135eecb4
LinuxLinux	Affected =6.1	Fixed in–

AI-suggested

A fix is available as described in the vendor commit that holds the hci_dev_lock during the entire enhanced SCO setup process. Users should apply the official Linux kernel patches that address this locking issue to prevent the use-after-free condition.

Description

A use-after-free vulnerability in the Linux kernel Bluetooth subsystem (hci_conn) was resolved. The flaw occurs during enhanced SCO setup when the parent ACL connection can be freed while still being accessed, due to missing locking around parent access. This can lead to a kernel memory use-after-free error.

Impact

The flaw can cause a kernel use-after-free memory error, potentially leading to kernel crashes or undefined behavior. No information about active exploitation or further impact is provided.

Summary

The vulnerability in the Linux kernel Bluetooth hci_conn component involves hci_enhanced_setup_sync() running without holding the hci_dev_lock, allowing a race condition where the ACL parent connection can be unlinked and freed while the function dereferences it. This results in a use-after-free condition. The issue was fixed by holding the hci_dev_lock across the codec switch and all calls to find_next_esco_param(), ensuring the parent connection remains valid during the setup process.

References

Community reviews

Loading reviews…