{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.113-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.2.10-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  Bluetooth: hci_conn: Lock parent access during enhanced SCO setup  Bluetooth: hci_conn: Lock parent access during enhanced SCO setup  hci_enhanced_setup_sync() runs on the request workqueue without the hci_dev_lock held by its caller when setup was queued. Its CVSD capability check and find_next_esco_param() dereference conn-\u003eparent while the receive workqueue can unlink and release that parent.  The following interleaving can cause a use-after-free:    hci_enhanced_setup_sync()       hci_disconn_complete_evt()   load conn-\u003eparent                                  hci_dev_lock()                                  hci_conn_del(ACL parent)                                    unlink SCO child                                    drop link's parent reference                                    clear child-\u003eparent                                    release ACL parent                                      bt_link_release()                                        kfree(parent)                                  hci_dev_unlock()   read parent-\u003efeatures[0][3]  The reference held for the queued SCO child does not keep its ACL parent alive after unlinking. Commit 42de40abe25d (\"Bluetooth: hci_conn: fix the SCO setup context lifetime\") protects the child stored in the queued context, but leaves these parent accesses unprotected.  With a 40 ms diagnostic delay after loading conn-\u003eparent, an instrumented kernel based on fd179f8a05be, which already contains 42de40abe25d,    BUG: KASAN: slab-use-after-free in hci_enhanced_setup_sync+0xda5/0xdf0   Read of size 1 at addr ffff888102204047 by task kworker/u17:0/93   Call Trace:    hci_enhanced_setup_sync+0xda5/0xdf0    hci_cmd_sync_work+0x13c/0x290    process_one_work+0x6b4/0x10e0    Allocated by task 92:    __hci_conn_add+0x304/0x1df0    hci_connect_acl+0x349/0x3e0    hci_connect_sco+0x3b/0x9a0    sco_sock_connect+0x475/0xca0    Freed by task 94:    kfree+0x121/0x3c0    bt_link_release+0x79/0xa0    device_release+0xc8/0x240    kobject_put+0x14d/0x280    hci_conn_del+0x524/0xe30    hci_disconn_complete_evt+0x403/0x8c0    hci_event_packet+0x71b/0xb20    hci_rx_work+0x293/0x730  The accessed address is 71 bytes into the freed ACL parent, at its features[0][3] byte; the queued SCO child is a different object. The diagnostic preserves the loaded parent across the delay, matching the unmodified compiled capability check, and does not change the parent references or teardown path.  Hold hci_dev_lock() across the codec switch, including every call to find_next_esco_param(), and release it on all selection errors. Keep configure_datapath_sync() outside the critical section because it waits for HCI events. Preserve parameter selection and existing return values.",
  "id": "DEBIAN-CVE-2026-98736",
  "modified": "2026-10-19T04:47:45.051169837Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-98736"
    }
  ],
  "upstream": [
    "CVE-2026-98736"
  ]
}