In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Serialize fragmented ISO packet queueing The fragmented… (CVE-2026-98733)

The vulnerability in the Linux kernel Bluetooth hci_core subsystem involves the fragmented path in hci_queue_iso() calling __skb_queue_tail() without holding the conn->data_q.lock. While the socket lock serializes senders, the transmit worker can concurrently dequeue packets using skb_dequeue(). This concurrency allows hci_sched_iso() to dequeue and pass a packet to the driver, which may free it before the insertion resumes and writes to the old tail's next pointer, causing a use-after-free. Concurrent updates can also corrupt the queue. KASAN detected a slab-use-after-free in hci_send_iso. The resolution is to hold the queue lock across the entire fragment batch, similar to hci_queue_acl(), to serialize insertion against dequeue and preserve fragment ordering.

The vulnerability can cause use-after-free conditions and queue corruption in the Bluetooth ISO packet queueing path of the Linux kernel. This can lead to memory corruption, potentially causing kernel crashes or undefined behavior. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix involves holding the queue lock during the entire fragment batch insertion to prevent concurrent queue modifications and use-after-free. Users should monitor official Linux kernel advisories for patches addressing this issue and apply them when available.