In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Fix inquiry cache use-after-free The sync command worker… (CVE-2026-98737)

The Linux kernel Bluetooth subsystem had a use-after-free vulnerability in the hci_sync code related to inquiry cache handling. The sync command worker held hdev->req_lock, but inquiry cache updates and flushes used hdev->lock. Functions hci_acl_create_conn_sync() and hci_stop_discovery_sync() accessed inquiry cache entries without holding hdev->lock, allowing a concurrent HCIINQUIRY ioctl to flush the cache and free entries while they were still being accessed. This caused use-after-free bugs detected by KASAN. The fix ensures hdev->lock is held during lookups and reads, copies remote addresses before unlocking, and releases the lock before sending synchronous HCI commands to avoid lock contention in completion handlers.

This vulnerability could lead to use-after-free memory access in the Bluetooth subsystem of the Linux kernel, potentially causing system instability or crashes. No information about exploitation in the wild or privilege escalation is provided.

A fix has been implemented in the Linux kernel to address this issue by correcting locking behavior and memory handling in the Bluetooth inquiry cache code. Users should apply the official kernel updates containing this fix when available. Patch status is not explicitly confirmed in the provided data; check the vendor advisory for current remediation guidance.