---
id: CVE-2026-98733
title: 'Bluetooth: hci_core: Serialize fragmented ISO packet queueing'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  Bluetooth: hci_core: Serialize fragmented ISO packet queueing

  The fragmented path in hci_queue_iso() calls __skb_queue_tail() without
  holding conn->data_q.lock. The so…
severity: high
cvss: 7
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: vendor
cwe:
  - CWE-416
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 26afbd826ee326e63a334c37fd45e82e50a615ec <
    545fa70f730eb648a610a2f4b2d270865f77b619
  - >-
    Linux >= 26afbd826ee326e63a334c37fd45e82e50a615ec <
    d6d709981208567868c5c01ebd1bec5e5e7fdab0
  - >-
    Linux >= 26afbd826ee326e63a334c37fd45e82e50a615ec <
    708cdd203d0bbcf9255fffb2e4c308d5b28851a7
  - >-
    Linux >= 26afbd826ee326e63a334c37fd45e82e50a615ec <
    a7161730a3ab3f0a3896000db7ab0284683936e6
  - >-
    Linux >= 26afbd826ee326e63a334c37fd45e82e50a615ec <
    1a572db43c057566771b485598ad2e66cb390821
  - Linux 6.0
published: '2026-10-18'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T12:56:09.003Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98733'
references:
  - url: 'https://git.kernel.org/stable/c/545fa70f730eb648a610a2f4b2d270865f77b619'
  - url: 'https://git.kernel.org/stable/c/d6d709981208567868c5c01ebd1bec5e5e7fdab0'
  - url: 'https://git.kernel.org/stable/c/708cdd203d0bbcf9255fffb2e4c308d5b28851a7'
  - url: 'https://git.kernel.org/stable/c/a7161730a3ab3f0a3896000db7ab0284683936e6'
  - url: 'https://git.kernel.org/stable/c/1a572db43c057566771b485598ad2e66cb390821'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98733.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-98733'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2555106'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-98733'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-98733'
  - url: 'https://kernelcve.org/list/?q=CVE-2026-98733'
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00168
epssPercentile: 0.05969
ingestedAt: '2026-10-18T16:47:32.505Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_core: Serialize fragmented ISO packet queueing

The fragmented path in hci_queue_iso() calls __skb_queue_tail() without
holding conn->data_q.lock. The socket lock serializes senders, but the
transmit worker can concurrently remove packets from this queue using
skb_dequeue().

After an insertion saves the old tail pointer, hci_sched_iso() can dequeue
that packet and pass it to the driver. The driver can free the packet
before the insertion resumes and writes to the old tail's next pointer,
causing a use-after-free. Concurrent updates can also corrupt the queue.

KASAN reported:

  BUG: KASAN: slab-use-after-free in hci_send_iso+0xc7d/0xe10
  Call Trace:
   hci_send_iso+0xc7d/0xe10
   iso_sock_sendmsg+0x710/0x900
   __sys_sendto+0x34a/0x3a0

  Allocated by task 86:
   __alloc_skb+0xdd/0x820
   alloc_skb_with_frags+0x7e/0x770
   sock_alloc_send_pskb+0x67a/0x820
   bt_skb_sendmsg.constprop.0+0xc0/0x6c0
   iso_sock_sendmsg+0x44e/0x900

  Freed by task 90:
   kmem_cache_free+0xcb/0x3d0
   vhci_read+0x33f/0x4d0
   vfs_read+0x177/0xa20

Hold the queue lock across the entire fragment batch, as hci_queue_acl()
does, to serialize insertion against dequeue while preserving fragment
ordering.

## Affected

- `Linux >= 26afbd826ee326e63a334c37fd45e82e50a615ec < 545fa70f730eb648a610a2f4b2d270865f77b619`
- `Linux >= 26afbd826ee326e63a334c37fd45e82e50a615ec < d6d709981208567868c5c01ebd1bec5e5e7fdab0`
- `Linux >= 26afbd826ee326e63a334c37fd45e82e50a615ec < 708cdd203d0bbcf9255fffb2e4c308d5b28851a7`
- `Linux >= 26afbd826ee326e63a334c37fd45e82e50a615ec < a7161730a3ab3f0a3896000db7ab0284683936e6`
- `Linux >= 26afbd826ee326e63a334c37fd45e82e50a615ec < 1a572db43c057566771b485598ad2e66cb390821`
- `Linux 6.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10 · no fix planned: Red Hat Enterprise Linux 10 · updated 2026-10-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98733.json)