{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-98736 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-98736 is an use after free vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-98736 and fix it if it is affected.\n\nWhat it is: CVE-2026-98736 is an use after free vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-98736 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-98736/ (Markdown: https://insights.sbomify.com/CVE-2026-98736/index.md)","id":"CVE-2026-98736","markdown":"https://insights.sbomify.com/CVE-2026-98736/index.md","name":"CVE-2026-98736","record":{"aliases":["AZL-109028","BELL-CVE-2026-98736","DEBIAN-CVE-2026-98736","GHSA-jxf9-629p-pmqw","UBUNTU-CVE-2026-98736"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["code_execution","privilege_escalation"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel Bluetooth","requires_auth":"low_privilege","summary":"A use-after-free in the Linux kernel Bluetooth subsystem allows local attackers to execute arbitrary code or escalate privileges via race conditions during SCO setup.","user_interaction":"not_required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_conn: Lock parent access during enhanced SCO setup\n\nBluetooth: hci_conn: Lock parent access during enhanced SCO setup\n\nhci_enhanced_setup_sync() runs on the request workqueue without the\nhci_dev_lock held by its caller when setup was queued. Its CVSD\ncapability check and find_next_esco_param() dereference conn-\u003eparent\nwhile the receive workqueue can unlink and release that parent.\n\nThe following interleaving can cause a use-after-free:\n\n  hci_enhanced_setup_sync()       hci_disconn_complete_evt()\n  load conn-\u003eparent\n                                 hci_dev_lock()\n                                 hci_conn_del(ACL parent)\n                                   unlink SCO child\n                                   drop link's parent reference\n                                   clear child-\u003eparent\n                                   release ACL parent\n                                     bt_link_release()\n                                       kfree(parent)\n                                 hci_dev_unlock()\n  read parent-\u003efeatures[0][3]\n\nThe reference held for the queued SCO child does not keep its ACL parent\nalive after unlinking. Commit 42de40abe25d (\"Bluetooth: hci_conn: fix the\nSCO setup context lifetime\") protects the child stored in the queued\ncontext, but leaves these parent accesses unprotected.\n\nWith a 40 ms diagnostic delay after loading conn-\u003eparent, an instrumented\nkernel based on fd179f8a05be, which already contains 42de40abe25d,\n\n  BUG: KASAN: slab-use-after-free in hci_enhanced_setup_sync+0xda5/0xdf0\n  Read of size 1 at addr ffff888102204047 by task kworker/u17:0/93\n  Call Trace:\n   hci_enhanced_setup_sync+0xda5/0xdf0\n   hci_cmd_sync_work+0x13c/0x290\n   process_one_work+0x6b4/0x10e0\n\n  Allocated by task 92:\n   __hci_conn_add+0x304/0x1df0\n   hci_connect_acl+0x349/0x3e0\n   hci_connect_sco+0x3b/0x9a0\n   sco_sock_connect+0x475/0xca0\n\n  Freed by task 94:\n   kfree+0x121/0x3c0\n   bt_link_release+0x79/0xa0\n   device_release+0xc8/0x240\n   kobject_put+0x14d/0x280\n   hci_conn_del+0x524/0xe30\n   hci_disconn_complete_evt+0x403/0x8c0\n   hci_event_packet+0x71b/0xb20\n   hci_rx_work+0x293/0x730\n\nThe accessed address is 71 bytes into the freed ACL parent, at its\nfeatures[0][3] byte; the queued SCO child is a different object. The\ndiagnostic preserves the loaded parent across the delay, matching the\nunmodified compiled capability check, and does not change the parent\nreferences or teardown path.\n\nHold hci_dev_lock() across the codec switch, including every call to\nfind_next_esco_param(), and release it on all selection errors. Keep\nconfigure_datapath_sync() outside the critical section because it waits\nfor HCI events. Preserve parameter selection and existing return values.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Bluetooth: hci_conn: Lock parent access during enhanced SCO setup","id":"CVE-2026-98736","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"use_after_free","year":"2026"},"n_packages":0,"n_references":5,"next":{"headline":"Bluetooth: hci_sync: Fix inquiry cache use-after-free","id":"CVE-2026-98737"},"packages":[],"prev":{"headline":"Bluetooth: hci_core: Serialize ACL scheduling with channel deletion","id":"CVE-2026-98735"},"products":["Linux"],"published":"2026-10-18","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-21","vendors":["Linux"]},"summary":"A use-after-free in the Linux kernel Bluetooth subsystem allows local attackers to execute arbitrary code or escalate privileges via race conditions during SCO setup.","url":"https://insights.sbomify.com/CVE-2026-98736/"}