In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: Lock parent access during enhanced SCO setup Bluetooth:… (CVE-2026-98736)

The vulnerability in the Linux kernel Bluetooth hci_conn component involves hci_enhanced_setup_sync() running without holding the hci_dev_lock, allowing a race condition where the ACL parent connection can be unlinked and freed while the function dereferences it. This results in a use-after-free condition. The issue was fixed by holding the hci_dev_lock across the codec switch and all calls to find_next_esco_param(), ensuring the parent connection remains valid during the setup process.

The flaw can cause a kernel use-after-free memory error, potentially leading to kernel crashes or undefined behavior. No information about active exploitation or further impact is provided.

A fix is available as described in the vendor commit that holds the hci_dev_lock during the entire enhanced SCO setup process. Users should apply the official Linux kernel patches that address this locking issue to prevent the use-after-free condition.