CVE-2026-98737

A use-after-free vulnerability exists in the Linux kernel Bluetooth subsystem within hci_sync . The issue stems from a race condition where the sync command worker holds hdev->req_lock, while inquiry-cache updates and flushes utilize hdev->lock. Specifically, functions hci_acl_create_conn_s...

CVE-2026-98737 Bluetooth: hci_sync: Fix inquiry cache use-after-free

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Fix inquiry cache use-after-free The sync command worker holds hdev-reqlock, but inquiry-cache updates and flushes use hdev-lock. Both hciaclcreateconnsync and hcistopdiscoverysync look up entries and read the...

CVE-2026-98737 Bluetooth: hci_sync: Fix inquiry cache use-after-free

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Fix inquiry cache use-after-free The sync command worker holds hdev-reqlock, but inquiry-cache updates and flushes use hdev-lock. Both hciaclcreateconnsync and hcistopdiscoverysync look up entries and read the...