CVE-2026-98738 Linux CVE debrief

Who should care

Linux kernel maintainers, Bluetooth-enabled system administrators, security teams responsible for Linux kernel patching, and operators of affected systems should assess and prioritize remediation efforts. They should review Linux kernel versions for potential exposure, verify Bluetooth-enabled systems for vulnerability, and apply kernel updates when available. Security teams should also verify affected scope and severity, and plan vendor-supported updates或

Why it matters

This CVE requires verification of affected Linux kernel versions and potential exposure in Bluetooth-enabled systems. Linux kernel maintainers, Bluetooth-enabled system administrators, and security teams responsible for Linux kernel patching should assess and prioritize remediation efforts.

• Potential system crashes or instability
• Possible code execution or privilege escalation
• Verification of affected Linux kernel versions required
• Remediation through kernel updates necessary

Technical summary

The Linux kernel's Bluetooth SMP implementation is vulnerable to a use-after-free issue. The build_pairing_cmd function accesses remote OOB data without holding the necessary lock, allowing concurrent management commands to invalidate or free the data. This can lead to potential crashes or code execution. Affected Linux kernel versions require verification, and Bluetooth-enabled system administrators should assess and prioritize remediation efforts. The vulnerability arises from SMP accessing remote OOB data without proper locking, enabling concurrent management commands to invalidate or free the data.

Defensive priority

Medium

Recommended defensive actions

• Review Linux kernel versions for potential exposure
• Verify Bluetooth-enabled systems for vulnerability
• Apply kernel updates when available
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including a KASAN report and stack traces. Multiple source references from the Linux kernel Git repository are also provided. To verify affected Linux kernel versions and potential exposure in Bluetooth-enabled systems, defenders should review the official advisory and CVE record, and assess system configurations. Evidence limits suggest that further verification is required to confirm affected scope and severity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.