Към съдържанието
Търсене

CVE-2026-98736: Linux

Няма оценка

CVSS

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: Lock parent access during enhanced SCO setup Bluetooth: hci_conn: Lock parent access during enhanced SCO setup hci_enhanced_setup_sync() runs on the request workqueue without the hci_dev_lock held by its caller when setup was queued. Its CVSD capability check and find_next_esco_param() dereference conn->parent while the receive workqueue can unlink and release that parent. The following interleaving can cause a use-after-free: hci_enhanced_setup_sync() hci_disconn_complete_evt() load conn->parent hci_dev_lock() hci_conn_del(ACL parent) unlink SCO child drop link's parent reference clear child->parent release ACL parent bt_link_release() kfree(parent) hci_dev_unlock() read parent->features[0][3] The reference held for the queued SCO child does not keep its ACL parent alive after unlinking. Commit 42de40abe25d ("Bluetooth: hci_conn: fix the SCO setup context lifetime") protects the child stored in the queued context, but leaves these parent accesses unprotected. With a 40 ms diagnostic delay after loading conn->parent, an instrumented kernel based on fd179f8a05be, which already contains 42de40abe25d, BUG: KASAN: slab-use-after-free in hci_enhanced_setup_sync+0xda5/0xdf0 Read of size 1 at addr ffff888102204047 by task kworker/u17:0/93 Call Trace: hci_enhanced_setup_sync+0xda5/0xdf0 hci_cmd_sync_work+0x13c/0x290 process_one_work+0x6b4/0x10e0 Allocated by task 92: __hci_conn_add+0x304/0x1df0 hci_connect_acl+0x349/0x3e0 hci_connect_sco+0x3b/0x9a0 sco_sock_connect+0x475/0xca0 Freed by task 94: kfree+0x121/0x3c0 bt_link

    Засегнати продукти

    • Linux Linux: e07a06b4eb417f5271d33ce2240e93c62d98b7b4 преди 48bf3b94c7331e11eaa6c89adc054a7bc7c0382e; e07a06b4eb417f5271d33ce2240e93c62d98b7b4 преди 70b55855eecb428d446344d827bda8725ce8b312; e07a06b4eb417f5271d33ce2240e93c62d98b7b4 преди 1239ef0fa809b5952fca679db3faa3e1c00e1dac; e07a06b4eb417f5271d33ce2240e93c62d98b7b4 преди cabd58d9bb66d49d481f762ce986173db397435d; e07a06b4eb417f5271d33ce2240e93c62d98b7b4 преди 93a737e4e042f59673cd580d35214f278d7b757d; e07a06b4eb417f5271d33ce2240e93c62d98b7b4 преди 024e05f73a4c1263d031614bc36700ec135eecb4
    • Linux Linux: 6.1; преди 6.1; 6.1.191 до 6.1.*; 6.6.160 до 6.6.*; 6.12.113 до 6.12.*; 6.18.56 до 6.18.*; 7.2.10 до 7.2.*; от 7.3 нататък

    История

    • 18 октомври 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-98736: Linux | freedomonline.bg