CVE-2026-98738

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98738", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.367Z", "datePublished": "2026-10-18T15:47:21.503Z", "dateUpdated": "2026-10-21T12:56:14.531Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:56:14.531Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: Serialize SMP remote OOB data access\n\nbuild_pairing_cmd() looks up remote OOB data and copies its contents\nwithout holding hdev->lock, which serializes the list's writers. After\nSMP finds an entry, a concurrent management Remove Remote OOB Data\ncommand can unlink and free it before SMP reads its present flag or\ncopies its random and confirmation values. Removal can also invalidate\nan entry while the lookup is still traversing the list.\n\nKASAN reported:\n\n BUG: KASAN: slab-use-after-free in build_pairing_cmd+0x948/0x9b0\n Call Trace:\n build_pairing_cmd+0x948/0x9b0\n smp_recv_cb+0x459f/0x8110\n l2cap_recv_frame+0xf14/0x9190\n l2cap_recv_acldata+0xa64/0xd40\n hci_rx_work+0x4ca/0x730\n\n Allocated by task 87:\n hci_add_remote_oob_data+0x11d/0x530\n add_remote_oob_data+0x282/0x400\n hci_sock_sendmsg+0x1033/0x1ea0\n\n Freed by task 93:\n hci_remote_oob_data_clear+0x108/0x1c0\n remove_remote_oob_data+0x198/0x220\n hci_sock_sendmsg+0x1033/0x1ea0\n\nTaking hdev->lock in build_pairing_cmd() would recurse for callers that\nalready hold it and invert the device-to-L2CAP lock order on the receive\npath. Add a per-device remote_oob_lock instead, held across the SMP\nlookup and copies and by the add, remove and clear helpers. Cover\ninitialization and in-place updates as well, so SMP cannot read partially\ninitialized or updated OOB values. Release the mutex on allocation\nfailure, preserving the existing error return.\n\nThe new critical sections acquire no device, connection or channel locks.\nWriters retain their existing hdev->lock protection, which continues to\nserialize the other readers without changing their locking or behavior."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/net/bluetooth/hci_core.h", "net/bluetooth/hci_core.c", "net/bluetooth/smp.c"], "versions": [{"version": "02b05bd8b0a632e9a26795bced8f19ca6a5f7079", "lessThan": "94afa17d6bfd5c1d367c56c8b63df5f695380861", "status": "affected", "versionType": "git"}, {"version": "02b05bd8b0a632e9a26795bced8f19ca6a5f7079", "lessThan": "1e11412a1b9854a89d044576d616675b16141d87", "status": "affected", "versionType": "git"}, {"version": "02b05bd8b0a632e9a26795bced8f19ca6a5f7079", "lessThan": "889c61e3d0f1091a958e4b2a24b20bab23d915c4", "status": "affected", "versionType": "git"}, {"version": "02b05bd8b0a632e9a26795bced8f19ca6a5f7079", "lessThan": "df5162eeb10e69fe0c2349503882c4a09077f001", "status": "affected", "versionType": "git"}, {"version": "02b05bd8b0a632e9a26795bced8f19ca6a5f7079", "lessThan": "81a2345f1984f0b36d3226571bc196316a01b648", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/net/bluetooth/hci_core.h", "net/bluetooth/hci_core.c", "net/bluetooth/smp.c"], "versions": [{"version": "3.19", "status": "affected"}, {"version": "0", "lessThan": "3.19", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.113", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.56", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.10", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.19", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.19", "versionEndExcluding": "6.12.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.19", "versionEndExcluding": "6.18.56"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.19", "versionEndExcluding": "7.2.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.19", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/94afa17d6bfd5c1d367c56c8b63df5f695380861"}, {"url": "https://git.kernel.org/stable/c/1e11412a1b9854a89d044576d616675b16141d87"}, {"url": "https://git.kernel.org/stable/c/889c61e3d0f1091a958e4b2a24b20bab23d915c4"}, {"url": "https://git.kernel.org/stable/c/df5162eeb10e69fe0c2349503882c4a09077f001"}, {"url": "https://git.kernel.org/stable/c/81a2345f1984f0b36d3226571bc196316a01b648"}], "title": "Bluetooth: Serialize SMP remote OOB data access", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["include/net/bluetooth/hci_core.h", "net/bluetooth/hci_core.c", "net/bluetooth/smp.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "94afa17d6bfd5c1d367c56c8b63df5f695380861", "status": "affected", "version": "02b05bd8b0a632e9a26795bced8f19ca6a5f7079", "versionType": "git"}, {"lessThan": "1e11412a1b9854a89d044576d616675b16141d87", "status": "affected", "version": "02b05bd8b0a632e9a26795bced8f19ca6a5f7079", "versionType": "git"}, {"lessThan": "889c61e3d0f1091a958e4b2a24b20bab23d915c4", "status": "affected", "version": "02b05bd8b0a632e9a26795bced8f19ca6a5f7079", "versionType": "git"}, {"lessThan": "df5162eeb10e69fe0c2349503882c4a09077f001", "status": "affected", "version": "02b05bd8b0a632e9a26795bced8f19ca6a5f7079", "versionType": "git"}, {"lessThan": "81a2345f1984f0b36d3226571bc196316a01b648", "status": "affected", "version": "02b05bd8b0a632e9a26795bced8f19ca6a5f7079", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["include/net/bluetooth/hci_core.h", "net/bluetooth/hci_core.c", "net/bluetooth/smp.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.19"}, {"lessThan": "3.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.113", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.56", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: Serialize SMP remote OOB data access\n\nbuild_pairing_cmd() looks up remote OOB data and copies its contents\nwithout holding hdev->lock, which serializes the list's writers. After\nSMP finds an entry, a concurrent management Remove Remote OOB Data\ncommand can unlink and free it before SMP reads its present flag or\ncopies its random and confirmation values. Removal can also invalidate\nan entry while the lookup is still traversing the list.\n\nKASAN reported:\n\n BUG: KASAN: slab-use-after-free in build_pairing_cmd+0x948/0x9b0\n Call Trace:\n build_pairing_cmd+0x948/0x9b0\n smp_recv_cb+0x459f/0x8110\n l2cap_recv_frame+0xf14/0x9190\n l2cap_recv_acldata+0xa64/0xd40\n hci_rx_work+0x4ca/0x730\n\n Allocated by task 87:\n hci_add_remote_oob_data+0x11d/0x530\n add_remote_oob_data+0x282/0x400\n hci_sock_sendmsg+0x1033/0x1ea0\n\n Freed by task 93:\n hci_remote_oob_data_clear+0x108/0x1c0\n remove_remote_oob_data+0x198/0x220\n hci_sock_sendmsg+0x1033/0x1ea0\n\nTaking hdev->lock in build_pairing_cmd() would recurse for callers that\nalready hold it and invert the device-to-L2CAP lock order on the receive\npath. Add a per-device remote_oob_lock instead, held across the SMP\nlookup and copies and by the add, remove and clear helpers. Cover\ninitialization and in-place updates as well, so SMP cannot read partially\ninitialized or updated OOB values. Release the mutex on allocation\nfailure, preserving the existing error return.\n\nThe new critical sections acquire no device, connection or channel locks.\nWriters retain their existing hdev->lock protection, which continues to\nserialize the other readers without changing their locking or behavior."}], "id": "CVE-2026-98738", "lastModified": "2026-10-21T13:21:41.040", "metrics": {}, "published": "2026-10-18T16:17:27.477", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1e11412a1b9854a89d044576d616675b16141d87"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/81a2345f1984f0b36d3226571bc196316a01b648"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/889c61e3d0f1091a958e4b2a24b20bab23d915c4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/94afa17d6bfd5c1d367c56c8b63df5f695380861"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/df5162eeb10e69fe0c2349503882c4a09077f001"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: kernel: denial of service via race condition in Bluetooth SMP remote OOB handling", "id": "2555076", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555076"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-416", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nBluetooth: Serialize SMP remote OOB data access\nbuild_pairing_cmd() looks up remote OOB data and copies its contents\nwithout holding hdev->lock, which serializes the list's writers. After\nSMP finds an entry, a concurrent management Remove Remote OOB Data\ncommand can unlink and free it before SMP reads its present flag or\ncopies its random and confirmation values. Removal can also invalidate\nan entry while the lookup is still traversing the list.\nKASAN reported:\nBUG: KASAN: slab-use-after-free in build_pairing_cmd+0x948/0x9b0\nCall Trace:\nbuild_pairing_cmd+0x948/0x9b0\nsmp_recv_cb+0x459f/0x8110\nl2cap_recv_frame+0xf14/0x9190\nl2cap_recv_acldata+0xa64/0xd40\nhci_rx_work+0x4ca/0x730\nAllocated by task 87:\nhci_add_remote_oob_data+0x11d/0x530\nadd_remote_oob_data+0x282/0x400\nhci_sock_sendmsg+0x1033/0x1ea0\nFreed by task 93:\nhci_remote_oob_data_clear+0x108/0x1c0\nremove_remote_oob_data+0x198/0x220\nhci_sock_sendmsg+0x1033/0x1ea0\nTaking hdev->lock in build_pairing_cmd() would recurse for callers that\nalready hold it and invert the device-to-L2CAP lock order on the receive\npath. Add a per-device remote_oob_lock instead, held across the SMP\nlookup and copies and by the add, remove and clear helpers. Cover\ninitialization and in-place updates as well, so SMP cannot read partially\ninitialized or updated OOB values. Release the mutex on allocation\nfailure, preserving the existing error return.\nThe new critical sections acquire no device, connection or channel locks.\nWriters retain their existing hdev->lock protection, which continues to\nserialize the other readers without changing their locking or behavior.", "A flaw was found in the Linux kernel's Bluetooth subsystem. A race condition occurs when the Security Manager Protocol (SMP) accesses remote Out-of-Band (OOB) pairing data without proper locking while the data is concurrently being removed. A local attacker can exploit this flaw to trigger a use-after-free memory error, resulting in a denial of service (DoS) or potentially arbitrary code execution."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-98738", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}], "public_date": "2026-10-18T15:47:21Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98738\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98738\nhttps://git.kernel.org/stable/c/1e11412a1b9854a89d044576d616675b16141d87\nhttps://git.kernel.org/stable/c/81a2345f1984f0b36d3226571bc196316a01b648\nhttps://git.kernel.org/stable/c/889c61e3d0f1091a958e4b2a24b20bab23d915c4\nhttps://git.kernel.org/stable/c/df5162eeb10e69fe0c2349503882c4a09077f001\nhttps://kernelcve.org/list/?q=CVE-2026-98738"], "statement": "A race in Bluetooth SMP remote OOB handling allows build_pairing_cmd to retain and read an oob_data entry after a concurrent management command removes and frees it. KASAN confirms a slab use-after-free while the receive path reads the present flag or copies remote random and confirmation values. A Bluetooth peer within radio range can exercise the SMP receive path, but reliable triggering also depends on a concurrent remote OOB removal or update and therefore has high attack complexity. For the CVSS the PR:N value is used for the paranoid adjacent attack scenario because the peer does not need an account or privileges on the target when a legitimate local Bluetooth service performs the concurrent removal. Impact is at least denial of service through a kernel crash and may include confidentiality or integrity impact if reclaimed slab contents are consumed as pairing data.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[02b05bd8b0a632e9a26795bced8f19ca6a5f7079,1e11412a1b9854a89d044576d616675b16141d87)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[02b05bd8b0a632e9a26795bced8f19ca6a5f7079,889c61e3d0f1091a958e4b2a24b20bab23d915c4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[02b05bd8b0a632e9a26795bced8f19ca6a5f7079,df5162eeb10e69fe0c2349503882c4a09077f001)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[02b05bd8b0a632e9a26795bced8f19ca6a5f7079,81a2345f1984f0b36d3226571bc196316a01b648)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.19"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,3.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.113,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.56,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.10,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T22:15:14.436066+00:00", "updated": "2026-10-22T20:45:05.389500+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}