{"id":"CVE-2026-98632","revision":"ba41237fedc140949122e0e6fef0e7d2","records":[{"revision":"ba41237fedc140949122e0e6fef0e7d2","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-98632","aliases":[],"title":"Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel\n\nIn send_cancel(), pending mesh_tx objects are removed from the\nhdev->mesh_pending list and freed via mesh_send_complete().  However, if\na mesh transmission was already queued onto hdev->cmd_sync_work_list via\nmesh_next(), the queued entry retains a raw pointer to mesh_tx.\n\nWhen hci_cmd_sync_work later processes the entry, it attempts to execute\nmesh_send_sync and its destroy callback mesh_send_start_complete using\nthe already freed mesh_tx pointer, leading to a use-after-free.\n\nFix this by invoking hci_cmd_sync_dequeue() for mesh_send_sync on the\ntarget mesh_tx before completing it.  If the entry is found and dequeued,\nits destroy callback will complete and free the object; otherwise,\nmesh_send_complete() is called directly.\n\nAdditionally, ensure the transmission queue advances after cancellation\nor errors.  In mesh_send_start_complete(), call mesh_next() on error\nunless err is -ECANCELED, because hci_cmd_sync_dequeue() holds\nhdev->cmd_sync_work_lock and calling mesh_next() synchronously would\ndeadlock.  Instead, advance the queue in send_cancel() once the lock is\nreleased and if no transmission is in progress.","state":0,"publishedAt":"2026-10-18T15:19:56.287+00:00","modifiedAt":"2026-10-19T09:23:00.46+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/bluetooth/mgmt.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"b338d91703fae6f6afd67f3f75caa3b8f36ddef3\",\n                            \"lessThan\": \"f84e52829021d00bca8e067302f597c71af1f71a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b338d91703fae6f6afd67f3f75caa3b8f36ddef3\",\n                            \"lessThan\": \"718a8ffa180d469f99ad4f746f00cafd39456415\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b338d91703fae6f6afd67f3f75caa3b8f36ddef3\",\n                            \"lessThan\": \"084be90948632a5a358821e687b11a14445aae76\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b338d91703fae6f6afd67f3f75caa3b8f36ddef3\",\n                            \"lessThan\": \"2189a219397d8e73808a67c4aade837b635705da\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b338d91703fae6f6afd67f3f75caa3b8f36ddef3\",\n                            \"lessThan\": \"03ced4687fb79286be7fdee0fc58d2c74de3e7bb\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b338d91703fae6f6afd67f3f75caa3b8f36ddef3\",\n                            \"lessThan\": \"71af682ba4692c2ed9ace4c3d4ca462ae368c029\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/bluetooth/mgmt.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.1\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.1\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.189\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.158\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.112\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.55\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.9\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/f84e52829021d00bca8e067302f597c71af1f71a","https://git.kernel.org/stable/c/718a8ffa180d469f99ad4f746f00cafd39456415","https://git.kernel.org/stable/c/084be90948632a5a358821e687b11a14445aae76","https://git.kernel.org/stable/c/2189a219397d8e73808a67c4aade837b635705da","https://git.kernel.org/stable/c/03ced4687fb79286be7fdee0fc58d2c74de3e7bb","https://git.kernel.org/stable/c/71af682ba4692c2ed9ace4c3d4ca462ae368c029"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98632","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-98632","identifiers":["CVE-2026-98632"]},"retained":false,"historicalAffected":[]}],"coverage":[]}