{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-99014", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.385Z", "datePublished": "2026-10-23T12:20:39.617Z", "dateUpdated": "2026-10-23T12:20:39.617Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-23T12:20:39.617Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: Fix command skb lifetime during scan setup\n\nDuring PA sync scan setup, hci_le_set_ext_scan_param_sync() gets the\naddress used for the PA_LINK lookup from hci_sent_cmd_data(). The\nreturned pointer borrows storage from sent_cmd or req_skb, without\nholding a reference to either skb.\n\nThe scan worker runs on req_workqueue while hci_cmd_work() runs on the\nseparate device workqueue. After the scan worker loads sent_cmd, the\ncommand worker can free and replace it before hci_sent_cmd_data()\ndereferences the skb. The command payload can also be freed between\nreturning from the helper and comparing the address. The connection\nlookup's RCU critical section does not protect the command skb.\n\nKASAN reported:\n\n BUG: KASAN: slab-use-after-free in hci_sent_cmd_data+0x27c/0x2f0\n Workqueue: hci0 hci_cmd_sync_work\n Call Trace:\n hci_sent_cmd_data+0x27c/0x2f0\n hci_le_set_scan_param_sync+0x43a/0x850\n hci_passive_scan_sync+0xb09/0x1460\n hci_update_passive_scan_sync+0x47c/0x6e0\n hci_le_pa_create_sync+0x200/0xa70\n hci_cmd_sync_work+0x13c/0x290\n\n Allocated by task 95:\n skb_clone+0x13f/0x340\n hci_cmd_work+0x2a9/0x7e0\n\n Freed by task 95:\n kmem_cache_free+0xba/0x3a0\n hci_cmd_work+0x29c/0x7e0\n\nUse hdev->lock to serialize the address snapshot with sent_cmd\nreplacement. Protect req_skb replacement and completion cleanup with\nthe same lock because the helper falls back to that skb. Copy the\naddress before releasing the lock and use the copy for the existing\nRCU-protected connection lookup. Release the mutex before sending or\nwaiting for commands, preserving the lookup and completion ordering." } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/bluetooth/hci_core.c", "net/bluetooth/hci_sync.c" ], "versions": [ { "version": "de3c85d321bfb85b7742a6cfab95d680da3e26b1", "lessThan": "f01cbddfb4273fcc9a786d13b0a2525029023605", "status": "affected", "versionType": "git" }, { "version": "22cbf4f84c00da64196eb15034feee868e63eef0", "lessThan": "119ba8070b3f112dd36c897f4f70ea5bb7d370b8", "status": "affected", "versionType": "git" }, { "version": "22cbf4f84c00da64196eb15034feee868e63eef0", "lessThan": "7db33b36213a3a1a40940c009ddac30670b55922", "status": "affected", "versionType": "git" }, { "version": "22cbf4f84c00da64196eb15034feee868e63eef0", "lessThan": "762850c203fab1190ad6a3de41cd51920b22236d", "status": "affected", "versionType": "git" }, { "version": "22cbf4f84c00da64196eb15034feee868e63eef0", "lessThan": "9af12272061d206af8bc3e40215cb694421ab73a", "status": "affected", "versionType": "git" }, { "version": "7a54f8314584f78fb0557153b1059924249ef628", "status": "affected", "versionType": "git" }, { "version": "6.6.28", "lessThan": "6.6.160", "status": "affected", "versionType": "semver" }, { "version": "6.8.7", "lessThan": "6.9", "status": "affected", "versionType": "semver" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/bluetooth/hci_core.c", "net/bluetooth/hci_sync.c" ], "versions": [ { "version": "6.9", "status": "affected" }, { "version": "0", "lessThan": "6.9", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.114", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.57", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.2.11", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.28", "versionEndExcluding": "6.6.160" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "6.12.114" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "6.18.57" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "7.2.11" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "7.3" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8.7" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/f01cbddfb4273fcc9a786d13b0a2525029023605" }, { "url": "https://git.kernel.org/stable/c/119ba8070b3f112dd36c897f4f70ea5bb7d370b8" }, { "url": "https://git.kernel.org/stable/c/7db33b36213a3a1a40940c009ddac30670b55922" }, { "url": "https://git.kernel.org/stable/c/762850c203fab1190ad6a3de41cd51920b22236d" }, { "url": "https://git.kernel.org/stable/c/9af12272061d206af8bc3e40215cb694421ab73a" } ], "title": "Bluetooth: hci_sync: Fix command skb lifetime during scan setup", "x_generator": { "engine": "bippy-1.2.0" } } } }