In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Serialize ACL scheduling with channel deletion… (CVE-2026-98735)

The vulnerability in the Linux kernel Bluetooth hci_core component involves improper synchronization between ACL scheduling and channel deletion. Specifically, hci_chan_sent() selects a channel under RCU but releases the read lock before accessing the channel's connection and returning the channel. Meanwhile, the ACL and LE schedulers use the channel's packet queue and update transmit counters without protection against channel deletion. If a disconnect command timeout occurs, hci_conn_failed() and l2cap_conn_del() can unlink and free the channel while it is still in use, causing use-after-free errors. The issue was detected by KASAN with detailed call traces. The remediation serializes channel selection and transmission with channel teardown by holding the device mutex, allowing safe concurrent operations and permitting the transmit path to sleep.

This vulnerability can cause use-after-free conditions in the Bluetooth subsystem of the Linux kernel, potentially leading to system instability or crashes. No information about remote code execution or privilege escalation is provided. There are no known exploits in the wild.

A fix is available that serializes ACL scheduling with channel deletion by holding the device mutex during channel selection and transmission. This prevents use-after-free conditions. Users should apply the official Linux kernel updates that include this fix. Since this is a kernel vulnerability, updating to a patched kernel version is the recommended remediation.