---
id: CVE-2026-98733
title: 'Bluetooth: hci_core: Serialize fragmented ISO packet queueing'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  Bluetooth: hci_core: Serialize fragmented ISO packet queueing

  The fragmented path in hci_queue_iso() calls __skb_queue_tail() without
  holding conn->data_q.lock. The so…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 26afbd826ee326e63a334c37fd45e82e50a615ec <
    d6d709981208567868c5c01ebd1bec5e5e7fdab0
  - >-
    Linux >= 26afbd826ee326e63a334c37fd45e82e50a615ec <
    708cdd203d0bbcf9255fffb2e4c308d5b28851a7
  - >-
    Linux >= 26afbd826ee326e63a334c37fd45e82e50a615ec <
    a7161730a3ab3f0a3896000db7ab0284683936e6
  - >-
    Linux >= 26afbd826ee326e63a334c37fd45e82e50a615ec <
    1a572db43c057566771b485598ad2e66cb390821
  - Linux 6.0
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T15:47:11.210Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98733'
references:
  - url: 'https://git.kernel.org/stable/c/d6d709981208567868c5c01ebd1bec5e5e7fdab0'
  - url: 'https://git.kernel.org/stable/c/708cdd203d0bbcf9255fffb2e4c308d5b28851a7'
  - url: 'https://git.kernel.org/stable/c/a7161730a3ab3f0a3896000db7ab0284683936e6'
  - url: 'https://git.kernel.org/stable/c/1a572db43c057566771b485598ad2e66cb390821'
tags:
  - cve.org
ingestedAt: '2026-10-18T16:47:32.505Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_core: Serialize fragmented ISO packet queueing

The fragmented path in hci_queue_iso() calls __skb_queue_tail() without
holding conn->data_q.lock. The socket lock serializes senders, but the
transmit worker can concurrently remove packets from this queue using
skb_dequeue().

After an insertion saves the old tail pointer, hci_sched_iso() can dequeue
that packet and pass it to the driver. The driver can free the packet
before the insertion resumes and writes to the old tail's next pointer,
causing a use-after-free. Concurrent updates can also corrupt the queue.

KASAN reported:

  BUG: KASAN: slab-use-after-free in hci_send_iso+0xc7d/0xe10
  Call Trace:
   hci_send_iso+0xc7d/0xe10
   iso_sock_sendmsg+0x710/0x900
   __sys_sendto+0x34a/0x3a0

  Allocated by task 86:
   __alloc_skb+0xdd/0x820
   alloc_skb_with_frags+0x7e/0x770
   sock_alloc_send_pskb+0x67a/0x820
   bt_skb_sendmsg.constprop.0+0xc0/0x6c0
   iso_sock_sendmsg+0x44e/0x900

  Freed by task 90:
   kmem_cache_free+0xcb/0x3d0
   vhci_read+0x33f/0x4d0
   vfs_read+0x177/0xa20

Hold the queue lock across the entire fragment batch, as hci_queue_acl()
does, to serialize insertion against dequeue while preserving fragment
ordering.

## Affected

- `Linux >= 26afbd826ee326e63a334c37fd45e82e50a615ec < d6d709981208567868c5c01ebd1bec5e5e7fdab0`
- `Linux >= 26afbd826ee326e63a334c37fd45e82e50a615ec < 708cdd203d0bbcf9255fffb2e4c308d5b28851a7`
- `Linux >= 26afbd826ee326e63a334c37fd45e82e50a615ec < a7161730a3ab3f0a3896000db7ab0284683936e6`
- `Linux >= 26afbd826ee326e63a334c37fd45e82e50a615ec < 1a572db43c057566771b485598ad2e66cb390821`
- `Linux 6.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.