In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Serialize SCO and ISO scheduling with teardown… (CVE-2026-98734)

The Linux kernel Bluetooth subsystem had a vulnerability where hci_low_sent() selected a connection under RCU but dropped the read lock before calculating its quota and returning it to the scheduler. This allowed hci_sched_iso() and hci_sched_sco() to use the connection without lifetime protection. After the TX worker dropped the RCU read lock, a concurrent hci_abort_conn_sync() could remove the connection, free its memory, and purge its queues. Subsequent TX worker operations could then access this freed connection, causing a use-after-free. The fix involves holding the hci_dev_lock() mutex across connection selection and transmission in SCO and ISO scheduling, serializing these operations with connection teardown to prevent use-after-free conditions. Additional adjustments ensure proper locking and scheduling order without recursive mutex acquisition.

The vulnerability could lead to use-after-free conditions in the Bluetooth kernel code, potentially causing kernel crashes or memory corruption. This could affect system stability and security, but no known exploits in the wild have been reported.

A fix for this vulnerability has been implemented in the Linux kernel by serializing SCO and ISO scheduling with connection teardown using the hci_dev_lock() mutex. Users should update to the fixed Linux kernel version once available. Patch status is not yet confirmed from the provided data; check the official Linux kernel advisories for current remediation guidance.