In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Fix command skb lifetime during scan setup During PA sync… (CVE-2026-99014)

The vulnerability in the Linux kernel Bluetooth hci_sync component involved the function hci_le_set_ext_scan_param_sync() obtaining an address pointer from hci_sent_cmd_data() that borrowed storage from sent_cmd or req_skb without holding a reference. Concurrent execution of scan and command workqueues could cause the command skb to be freed and replaced before dereferencing, leading to a use-after-free condition. Kernel Address Sanitizer (KASAN) detected this as a slab-use-after-free bug. The fix involved serializing access with hdev->lock to protect address snapshots and skb replacements, copying the address before releasing the lock, and preserving proper ordering of lookups and command completions.

The vulnerability could lead to use-after-free memory corruption within the Bluetooth subsystem of the Linux kernel. This may cause system instability or crashes. No information about active exploitation or remote code execution is provided.

A fix has been implemented in the Linux kernel to address this issue by adding proper locking and copying of pointers to prevent use-after-free conditions. Users should apply the official kernel updates that include this patch. Since this is a kernel-level vulnerability, updating to a patched kernel version is the recommended remediation. Patch status is not explicitly stated; check the vendor or Linux kernel advisories for the specific fixed versions and update accordingly.