In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel In… (CVE-2026-98632)

The vulnerability in the Linux kernel Bluetooth mesh management involves improper handling of pending mesh_send_sync entries during cancellation. Specifically, in send_cancel(), mesh_tx objects are removed and freed, but if a mesh transmission was already queued on hdev->cmd_sync_work_list, the queued entry retains a raw pointer to the freed mesh_tx. When processed later by hci_cmd_sync_work, this causes a use-after-free. The fix invokes hci_cmd_sync_dequeue() to remove the queued entry before freeing the mesh_tx, ensuring the destroy callback completes properly. Additionally, the transmission queue is advanced after cancellation or errors to prevent deadlocks caused by synchronous calls while holding locks.

This vulnerability can lead to use-after-free conditions in the Bluetooth mesh transmission code of the Linux kernel, potentially causing kernel crashes or undefined behavior. No known exploits in the wild have been reported. The impact is limited to affected Linux kernel Bluetooth mesh management functionality.

A fix has been implemented to address this vulnerability by properly dequeuing pending mesh_send_sync entries before freeing associated objects and ensuring the transmission queue advances correctly after cancellation or errors. Users should apply the official Linux kernel updates that include this fix. Patch status is not explicitly stated; check the vendor or Linux kernel advisory for the current remediation guidance.