CVE-2026-98735 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Bluetooth HCI core developers, users of Linux-based systems that use Bluetooth, system administrators, security teams, and operators of Linux-based infrastructure and services that rely on Bluetooth connectivity for device communication.

Why it matters

The Linux kernel's Bluetooth HCI core has a use-after-free vulnerability that can lead to potential denial of service (DoS) or remote code execution (RCE). Linux kernel developers and maintainers, Bluetooth HCI core developers, and users of Linux-based systems that use Bluetooth should review and apply the provided kernel patches to fix the vulnerability.

• Potential denial of service (DoS) due to use-after-free error
• Potential remote code execution (RCE) if exploitation is possible

Technical summary

The Linux kernel's Bluetooth HCI core has a use-after-free vulnerability caused by the lack of serialization between channel selection and transmission with channel deletion. This can lead to a use-after-free error when the transmission path resumes after a disconnect command timeout. The vulnerability can potentially allow for denial of service (DoS) or remote code execution (RCE). Linux kernel developers and maintainers, Bluetooth HCI core developers, and users of Linux-based systems that use Bluetooth should review and apply the provided kernel patches to fix the vulnerability.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the provided kernel patches to fix the vulnerability
• Ensure that the Linux kernel is updated to a version that includes the fix
• Monitor system logs for potential exploitation attempts
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The Linux kernel's Bluetooth HCI core has a use-after-free vulnerability. The vulnerability is caused by the lack of serialization between channel selection and transmission with channel deletion. This can lead to a use-after-free error when the transmission path resumes after a disconnect command timeout.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.