In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Serialize SMP remote OOB data access build_pairing_cmd() looks up… (CVE-2026-98738)

The Linux kernel Bluetooth subsystem had a vulnerability in the build_pairing_cmd() function, which looked up and copied remote SMP OOB data without holding the appropriate lock (hdev->lock). This allowed a concurrent Remove Remote OOB Data command to unlink and free the data while it was still being accessed, causing use-after-free conditions detected by KASAN. The fix added a per-device remote_oob_lock mutex to serialize access to the OOB data during lookup and modification, preventing reading partially initialized or freed data. This change avoids recursion and lock order inversion by not reusing hdev->lock and does not alter existing locking behavior for other readers or writers.

The vulnerability could cause kernel memory corruption or crashes due to use-after-free conditions in the Bluetooth SMP pairing process. This undermines system stability and could be leveraged for denial of service or potentially privilege escalation if exploited. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to address this vulnerability by adding a dedicated mutex for remote OOB data access. Users should update to the patched kernel versions once available. Patch status is not yet confirmed in this data; check the official Linux kernel advisories or vendor updates for the specific fixed versions and apply them accordingly.