Vulnerability-Lookup

GHSA-PM9C-823Q-M3HJ

Vulnerability from github – Published: 2026-10-23 15:31 – Updated: 2026-10-24 15:32

Details

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_sync: Fix command skb lifetime during scan setup

During PA sync scan setup, hci_le_set_ext_scan_param_sync() gets the address used for the PA_LINK lookup from hci_sent_cmd_data(). The returned pointer borrows storage from sent_cmd or req_skb, without holding a reference to either skb.

The scan worker runs on req_workqueue while hci_cmd_work() runs on the separate device workqueue. After the scan worker loads sent_cmd, the command worker can free and replace it before hci_sent_cmd_data() dereferences the skb. The command payload can also be freed between returning from the helper and comparing the address. The connection lookup's RCU critical section does not protect the command skb.

KASAN reported:

BUG: KASAN: slab-use-after-free in hci_sent_cmd_data+0x27c/0x2f0 Workqueue: hci0 hci_cmd_sync_work Call Trace: hci_sent_cmd_data+0x27c/0x2f0 hci_le_set_scan_param_sync+0x43a/0x850 hci_passive_scan_sync+0xb09/0x1460 hci_update_passive_scan_sync+0x47c/0x6e0 hci_le_pa_create_sync+0x200/0xa70 hci_cmd_sync_work+0x13c/0x290

Allocated by task 95: skb_clone+0x13f/0x340 hci_cmd_work+0x2a9/0x7e0

Freed by task 95: kmem_cache_free+0xba/0x3a0 hci_cmd_work+0x29c/0x7e0

Use hdev->lock to serialize the address snapshot with sent_cmd replacement. Protect req_skb replacement and completion cleanup with the same lock because the helper falls back to that skb. Copy the address before releasing the lock and use the copy for the existing RCU-protected connection lookup. Release the mutex before sending or waiting for commands, preserving the lookup and completion ordering.

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-99014"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-23T13:17:24Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: Fix command skb lifetime during scan setup\n\nDuring PA sync scan setup, hci_le_set_ext_scan_param_sync() gets the\naddress used for the PA_LINK lookup from hci_sent_cmd_data(). The\nreturned pointer borrows storage from sent_cmd or req_skb, without\nholding a reference to either skb.\n\nThe scan worker runs on req_workqueue while hci_cmd_work() runs on the\nseparate device workqueue. After the scan worker loads sent_cmd, the\ncommand worker can free and replace it before hci_sent_cmd_data()\ndereferences the skb. The command payload can also be freed between\nreturning from the helper and comparing the address. The connection\nlookup\u0027s RCU critical section does not protect the command skb.\n\nKASAN reported:\n\n  BUG: KASAN: slab-use-after-free in hci_sent_cmd_data+0x27c/0x2f0\n  Workqueue: hci0 hci_cmd_sync_work\n  Call Trace:\n   hci_sent_cmd_data+0x27c/0x2f0\n   hci_le_set_scan_param_sync+0x43a/0x850\n   hci_passive_scan_sync+0xb09/0x1460\n   hci_update_passive_scan_sync+0x47c/0x6e0\n   hci_le_pa_create_sync+0x200/0xa70\n   hci_cmd_sync_work+0x13c/0x290\n\n  Allocated by task 95:\n   skb_clone+0x13f/0x340\n   hci_cmd_work+0x2a9/0x7e0\n\n  Freed by task 95:\n   kmem_cache_free+0xba/0x3a0\n   hci_cmd_work+0x29c/0x7e0\n\nUse hdev-\u003elock to serialize the address snapshot with sent_cmd\nreplacement. Protect req_skb replacement and completion cleanup with\nthe same lock because the helper falls back to that skb. Copy the\naddress before releasing the lock and use the copy for the existing\nRCU-protected connection lookup. Release the mutex before sending or\nwaiting for commands, preserving the lookup and completion ordering.",
  "id": "GHSA-pm9c-823q-m3hj",
  "modified": "2026-10-24T15:32:49Z",
  "published": "2026-10-23T15:31:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99014"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/119ba8070b3f112dd36c897f4f70ea5bb7d370b8"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/762850c203fab1190ad6a3de41cd51920b22236d"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/7db33b36213a3a1a40940c009ddac30670b55922"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/9af12272061d206af8bc3e40215cb694421ab73a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f01cbddfb4273fcc9a786d13b0a2525029023605"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2026-99014 (GCVE-0-2026-99014)

Vulnerability from cvelistv5 – Published: 2026-10-23 12:20 – Updated: 2026-10-24 14:10

Title

Bluetooth: hci_sync: Fix command skb lifetime during scan setup

Summary

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Fix command skb lifetime during scan setup During PA sync scan setup, hci_le_set_ext_scan_param_sync() gets the address used for the PA_LINK lookup from hci_sent_cmd_data(). The returned pointer borrows storage from sent_cmd or req_skb, without holding a reference to either skb. The scan worker runs on req_workqueue while hci_cmd_work() runs on the separate device workqueue. After the scan worker loads sent_cmd, the command worker can free and replace it before hci_sent_cmd_data() dereferences the skb. The command payload can also be freed between returning from the helper and comparing the address. The connection lookup's RCU critical section does not protect the command skb. KASAN reported: BUG: KASAN: slab-use-after-free in hci_sent_cmd_data+0x27c/0x2f0 Workqueue: hci0 hci_cmd_sync_work Call Trace: hci_sent_cmd_data+0x27c/0x2f0 hci_le_set_scan_param_sync+0x43a/0x850 hci_passive_scan_sync+0xb09/0x1460 hci_update_passive_scan_sync+0x47c/0x6e0 hci_le_pa_create_sync+0x200/0xa70 hci_cmd_sync_work+0x13c/0x290 Allocated by task 95: skb_clone+0x13f/0x340 hci_cmd_work+0x2a9/0x7e0 Freed by task 95: kmem_cache_free+0xba/0x3a0 hci_cmd_work+0x29c/0x7e0 Use hdev->lock to serialize the address snapshot with sent_cmd replacement. Protect req_skb replacement and completion cleanup with the same lock because the helper falls back to that skb. Copy the address before releasing the lock and use the copy for the existing RCU-protected connection lookup. Release the mutex before sending or waiting for commands, preserving the lookup and completion ordering.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 7056 records in the last 180 days details

References

5 references

URL	Tags
https://git.kernel.org/stable/c/f01cbddfb4273fcc9…
https://git.kernel.org/stable/c/119ba8070b3f112dd…
https://git.kernel.org/stable/c/7db33b36213a3a1a4…
https://git.kernel.org/stable/c/762850c203fab1190…
https://git.kernel.org/stable/c/9af12272061d206af…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: de3c85d321bfb85b7742a6cfab95d680da3e26b1 , < f01cbddfb4273fcc9a786d13b0a2525029023605 (git) Affected: 22cbf4f84c00da64196eb15034feee868e63eef0 , < 119ba8070b3f112dd36c897f4f70ea5bb7d370b8 (git) Affected: 22cbf4f84c00da64196eb15034feee868e63eef0 , < 7db33b36213a3a1a40940c009ddac30670b55922 (git) Affected: 22cbf4f84c00da64196eb15034feee868e63eef0 , < 762850c203fab1190ad6a3de41cd51920b22236d (git) Affected: 22cbf4f84c00da64196eb15034feee868e63eef0 , < 9af12272061d206af8bc3e40215cb694421ab73a (git) Affected: 7a54f8314584f78fb0557153b1059924249ef628 (git) Affected: 6.6.28 , < 6.6.160 (semver) Affected: 6.8.7 , < 6.9 (semver)
Linux	Linux	Affected: 6.9 Unaffected: 0 , < 6.9 (semver) Unaffected: 6.6.160 , ≤ 6.6.* (semver) Unaffected: 6.12.114 , ≤ 6.12.* (semver) Unaffected: 6.18.57 , ≤ 6.18.* (semver) Unaffected: 7.2.11 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_core.c",
            "net/bluetooth/hci_sync.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f01cbddfb4273fcc9a786d13b0a2525029023605",
              "status": "affected",
              "version": "de3c85d321bfb85b7742a6cfab95d680da3e26b1",
              "versionType": "git"
            },
            {
              "lessThan": "119ba8070b3f112dd36c897f4f70ea5bb7d370b8",
              "status": "affected",
              "version": "22cbf4f84c00da64196eb15034feee868e63eef0",
              "versionType": "git"
            },
            {
              "lessThan": "7db33b36213a3a1a40940c009ddac30670b55922",
              "status": "affected",
              "version": "22cbf4f84c00da64196eb15034feee868e63eef0",
              "versionType": "git"
            },
            {
              "lessThan": "762850c203fab1190ad6a3de41cd51920b22236d",
              "status": "affected",
              "version": "22cbf4f84c00da64196eb15034feee868e63eef0",
              "versionType": "git"
            },
            {
              "lessThan": "9af12272061d206af8bc3e40215cb694421ab73a",
              "status": "affected",
              "version": "22cbf4f84c00da64196eb15034feee868e63eef0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "7a54f8314584f78fb0557153b1059924249ef628",
              "versionType": "git"
            },
            {
              "lessThan": "6.6.160",
              "status": "affected",
              "version": "6.6.28",
              "versionType": "semver"
            },
            {
              "lessThan": "6.9",
              "status": "affected",
              "version": "6.8.7",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_core.c",
            "net/bluetooth/hci_sync.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.114",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.57",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.160",
                  "versionStartIncluding": "6.6.28",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.114",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.57",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.11",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.8.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: Fix command skb lifetime during scan setup\n\nDuring PA sync scan setup, hci_le_set_ext_scan_param_sync() gets the\naddress used for the PA_LINK lookup from hci_sent_cmd_data(). The\nreturned pointer borrows storage from sent_cmd or req_skb, without\nholding a reference to either skb.\n\nThe scan worker runs on req_workqueue while hci_cmd_work() runs on the\nseparate device workqueue. After the scan worker loads sent_cmd, the\ncommand worker can free and replace it before hci_sent_cmd_data()\ndereferences the skb. The command payload can also be freed between\nreturning from the helper and comparing the address. The connection\nlookup\u0027s RCU critical section does not protect the command skb.\n\nKASAN reported:\n\n  BUG: KASAN: slab-use-after-free in hci_sent_cmd_data+0x27c/0x2f0\n  Workqueue: hci0 hci_cmd_sync_work\n  Call Trace:\n   hci_sent_cmd_data+0x27c/0x2f0\n   hci_le_set_scan_param_sync+0x43a/0x850\n   hci_passive_scan_sync+0xb09/0x1460\n   hci_update_passive_scan_sync+0x47c/0x6e0\n   hci_le_pa_create_sync+0x200/0xa70\n   hci_cmd_sync_work+0x13c/0x290\n\n  Allocated by task 95:\n   skb_clone+0x13f/0x340\n   hci_cmd_work+0x2a9/0x7e0\n\n  Freed by task 95:\n   kmem_cache_free+0xba/0x3a0\n   hci_cmd_work+0x29c/0x7e0\n\nUse hdev-\u003elock to serialize the address snapshot with sent_cmd\nreplacement. Protect req_skb replacement and completion cleanup with\nthe same lock because the helper falls back to that skb. Copy the\naddress before releasing the lock and use the copy for the existing\nRCU-protected connection lookup. Release the mutex before sending or\nwaiting for commands, preserving the lookup and completion ordering."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - A local listen(2) on a broadcast BTPROTO_ISO socket reaches iso_sock_listen() \u2192 iso_listen_bis() \u2192 hci_pa_create_sync() \u2192 hci_le_pa_create_sync() \u2192 hci_le_set_ext_scan_param_sync(). No received Bluetooth PDU initiates this PA-sync setup.\nAC:L - The attacker can run the ISO listen while flooding security-filter-permitted HCI_OP_READ_LOCAL_VERSION commands through a raw HCI socket; hci_sock_sendmsg() queues them on hdev-\u003ecmd_q, making hci_cmd_work() race hci_sent_cmd_data() on the separate req_workqueue.\nPR:L - iso_sock_create(), bind(), and listen() have no capability check, while an unprivileged raw HCI socket may submit HCI_OP_READ_LOCAL_VERSION because OGF_INFO_PARAM/OCF 1 is in hci_sec_filter. Bluetooth sockets require init_net, but an ordinary host user satisfies that condition.\nUI:N - The attacking process itself binds and listens on the broadcast ISO socket and submits the racing raw HCI commands; no separate victim action is needed once ISO sockets and the adapter are enabled.\nS:U - The stale sent_cmd or req_skb and resulting memory access remain within the host kernel\u0027s Bluetooth authority; hci_le_set_ext_scan_param_sync() crosses no VM, IOMMU, or other security boundary.\nC:H - hci_cmd_data() dereferences len and data from a freed sk_buff, and the returned command-payload pointer can itself be freed before the six-byte bdaddr read. Reclaiming the sprayable skbuff_head_cache object therefore supplies an attacker-directed stale-pointer read primitive.\nI:H - A reclaimed command sk_buff controls the stale len/data fields and the bdaddr used to select a PA_LINK, whose iso_qos then determines the HCI_OP_LE_SET_EXT_SCAN_PARAMS command. This sprayable kernel use-after-free is an integrity-high memory-corruption primitive.\nA:H - KASAN confirmed a slab-use-after-free in hci_sent_cmd_data(); dereferencing the freed sk_buff or its released payload can fault in hci_cmd_sync_work and cause a kernel oops or panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-24T14:10:02.640Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f01cbddfb4273fcc9a786d13b0a2525029023605"
        },
        {
          "url": "https://git.kernel.org/stable/c/119ba8070b3f112dd36c897f4f70ea5bb7d370b8"
        },
        {
          "url": "https://git.kernel.org/stable/c/7db33b36213a3a1a40940c009ddac30670b55922"
        },
        {
          "url": "https://git.kernel.org/stable/c/762850c203fab1190ad6a3de41cd51920b22236d"
        },
        {
          "url": "https://git.kernel.org/stable/c/9af12272061d206af8bc3e40215cb694421ab73a"
        }
      ],
      "title": "Bluetooth: hci_sync: Fix command skb lifetime during scan setup",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-99014",
    "datePublished": "2026-10-23T12:20:39.617Z",
    "dateReserved": "2026-09-25T10:25:14.385Z",
    "dateUpdated": "2026-10-24T14:10:02.640Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted