# CVE-2026-98733: Bluetooth: hci_core: Serialize fragmented ISO packet queueing

> A race condition in the Linux kernel Bluetooth ISO packet handling allows local attackers to trigger a use-after-free, potentially leading to code execution or system crashes.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Any signed-in user
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 18 Oct 2026
- **Updated:** 21 Oct 2026
- **Also known as:** AZL-109272, BELL-CVE-2026-98733, DEBIAN-CVE-2026-98733, GHSA-25g3-wm5v-78g8, UBUNTU-CVE-2026-98733

## What is CVE-2026-98733?

CVE-2026-98733 is an use after free vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_core: Serialize fragmented ISO packet queueing

The fragmented path in hci_queue_iso() calls __skb_queue_tail() without
holding conn->data_q.lock. The socket lock serializes senders, but the
transmit worker can concurrently remove packets from this queue using
skb_dequeue().

After an insertion saves the old tail pointer, hci_sched_iso() can dequeue
that packet and pass it to the driver. The driver can free the packet
before the insertion resumes and writes to the old tail's next pointer,
causing a use-after-free. Concurrent updates can also corrupt the queue.

KASAN reported:

  BUG: KASAN: slab-use-after-free in hci_send_iso+0xc7d/0xe10
  Call Trace:
   hci_send_iso+0xc7d/0xe10
   iso_sock_sendmsg+0x710/0x900
   __sys_sendto+0x34a/0x3a0

  Allocated by task 86:
   __alloc_skb+0xdd/0x820
   alloc_skb_with_frags+0x7e/0x770
   sock_alloc_send_pskb+0x67a/0x820
   bt_skb_sendmsg.constprop.0+0xc0/0x6c0
   iso_sock_sendmsg+0x44e/0x900

  Freed by task 90:
   kmem_cache_free+0xcb/0x3d0
   vhci_read+0x33f/0x4d0
   vfs_read+0x177/0xa20

Hold the queue lock across the entire fragment batch, as hci_queue_acl()
does, to serialize insertion against dequeue while preserving fragment
ordering.

## Which versions are affected by CVE-2026-98733?


## How do I fix CVE-2026-98733?

Apply the vendor's patch.

## Is CVE-2026-98733 being exploited?

There is no known exploitation of CVE-2026-98733 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-98733 and fix it if it is affected.

What it is: CVE-2026-98733 is an use after free vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-98733 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-98733/ (Markdown: https://insights.sbomify.com/CVE-2026-98733/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-98733
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-98733
- OSV: https://osv.dev/vulnerability/CVE-2026-98733

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-98733/
Summaries are generated and may contain mistakes; the official description above is the record.