CVE-2026-98737

A use-after-free vulnerability exists in the Linux kernel Bluetooth subsystem within hci_sync . The issue stems from a race condition where the sync command worker holds hdev->req_lock, while inquiry-cache updates and flushes utilize hdev->lock. Specifically, functions hci_acl_create_conn_s...