{"id":"CVE-2026-99014","revision":"6866fbc98d874837b3f836271d9aafdc","records":[{"revision":"6866fbc98d874837b3f836271d9aafdc","observedAt":"2026-10-24T16:17:04.479+00:00","statement":{"source":"cve-program","id":"CVE-2026-99014","aliases":[],"title":"Bluetooth: hci_sync: Fix command skb lifetime during scan setup","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: Fix command skb lifetime during scan setup\n\nDuring PA sync scan setup, hci_le_set_ext_scan_param_sync() gets the\naddress used for the PA_LINK lookup from hci_sent_cmd_data(). The\nreturned pointer borrows storage from sent_cmd or req_skb, without\nholding a reference to either skb.\n\nThe scan worker runs on req_workqueue while hci_cmd_work() runs on the\nseparate device workqueue. After the scan worker loads sent_cmd, the\ncommand worker can free and replace it before hci_sent_cmd_data()\ndereferences the skb. The command payload can also be freed between\nreturning from the helper and comparing the address. The connection\nlookup's RCU critical section does not protect the command skb.\n\nKASAN reported:\n\n BUG: KASAN: slab-use-after-free in hci_sent_cmd_data+0x27c/0x2f0\n Workqueue: hci0 hci_cmd_sync_work\n Call Trace:\n hci_sent_cmd_data+0x27c/0x2f0\n hci_le_set_scan_param_sync+0x43a/0x850\n hci_passive_scan_sync+0xb09/0x1460\n hci_update_passive_scan_sync+0x47c/0x6e0\n hci_le_pa_create_sync+0x200/0xa70\n hci_cmd_sync_work+0x13c/0x290\n\n Allocated by task 95:\n skb_clone+0x13f/0x340\n hci_cmd_work+0x2a9/0x7e0\n\n Freed by task 95:\n kmem_cache_free+0xba/0x3a0\n hci_cmd_work+0x29c/0x7e0\n\nUse hdev->lock to serialize the address snapshot with sent_cmd\nreplacement. Protect req_skb replacement and completion cleanup with\nthe same lock because the helper falls back to that skb. Copy the\naddress before releasing the lock and use the copy for the existing\nRCU-protected connection lookup. Release the mutex before sending or\nwaiting for commands, preserving the lookup and completion ordering.","state":0,"publishedAt":"2026-10-23T12:20:39.617+00:00","modifiedAt":"2026-10-24T14:10:02.64+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"product\": \"Linux\",\n \"vendor\": \"Linux\",\n \"defaultStatus\": \"unaffected\",\n \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n \"programFiles\": [\n \"net/bluetooth/hci_core.c\",\n \"net/bluetooth/hci_sync.c\"\n ],\n \"versions\": [\n {\n \"version\": \"de3c85d321bfb85b7742a6cfab95d680da3e26b1\",\n \"lessThan\": \"f01cbddfb4273fcc9a786d13b0a2525029023605\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"22cbf4f84c00da64196eb15034feee868e63eef0\",\n \"lessThan\": \"119ba8070b3f112dd36c897f4f70ea5bb7d370b8\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"22cbf4f84c00da64196eb15034feee868e63eef0\",\n \"lessThan\": \"7db33b36213a3a1a40940c009ddac30670b55922\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"22cbf4f84c00da64196eb15034feee868e63eef0\",\n \"lessThan\": \"762850c203fab1190ad6a3de41cd51920b22236d\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"22cbf4f84c00da64196eb15034feee868e63eef0\",\n \"lessThan\": \"9af12272061d206af8bc3e40215cb694421ab73a\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"7a54f8314584f78fb0557153b1059924249ef628\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"6.6.28\",\n \"lessThan\": \"6.6.160\",\n \"status\": \"affected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.8.7\",\n \"lessThan\": \"6.9\",\n \"status\": \"affected\",\n \"versionType\": \"semver\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"product\": \"Linux\",\n \"vendor\": \"Linux\",\n \"defaultStatus\": \"affected\",\n \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n \"programFiles\": [\n \"net/bluetooth/hci_core.c\",\n \"net/bluetooth/hci_sync.c\"\n ],\n \"versions\": [\n {\n \"version\": \"6.9\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"0\",\n \"lessThan\": \"6.9\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.6.160\",\n \"lessThanOrEqual\": \"6.6.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.12.114\",\n \"lessThanOrEqual\": \"6.12.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.18.57\",\n \"lessThanOrEqual\": \"6.18.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"7.2.11\",\n \"lessThanOrEqual\": \"7.2.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"7.3\",\n \"lessThanOrEqual\": \"*\",\n \"status\": \"unaffected\",\n \"versionType\": \"original_commit_for_fix\"\n }\n ]\n }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/f01cbddfb4273fcc9a786d13b0a2525029023605","https://git.kernel.org/stable/c/119ba8070b3f112dd36c897f4f70ea5bb7d370b8","https://git.kernel.org/stable/c/7db33b36213a3a1a40940c009ddac30670b55922","https://git.kernel.org/stable/c/762850c203fab1190ad6a3de41cd51920b22236d","https://git.kernel.org/stable/c/9af12272061d206af8bc3e40215cb694421ab73a"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-99014","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-99014","identifiers":["CVE-2026-99014"]},"retained":false,"historicalAffected":[]}],"coverage":[]}