CVE-2026-99014 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, as well as users of Linux-based systems that utilize Bluetooth functionality, should assess exposure and apply patches. The vulnerability affects the Linux kernel's Bluetooth hci_sync component and could lead to system crashes, code execution, or denial-of-service attacks.

Why it matters

This vulnerability affects the Linux kernel's Bluetooth hci_sync component and could lead to system crashes, code execution, or denial-of-service attacks. Linux kernel developers and users of Linux-based systems with Bluetooth functionality should assess exposure and apply patches.

• Potential system crashes or instability due to use-after-free errors
• Possible code execution or privilege escalation
• Increased risk of denial-of-service (DoS) attacks

Technical summary

The vulnerability exists in the Linux kernel's Bluetooth hci_sync component. During scan setup, the hci_le_set_ext_scan_param_sync function accesses a command skb after it has been freed, leading to a use-after-free error. The vulnerability affects the Linux kernel's Bluetooth hci_sync component and could lead to system crashes, code execution, or denial-of-service attacks. Linux kernel developers and users of Linux-based systems with Bluetooth functionality should assess exposure and apply patches. The issue arises during scan setup when the hci_le_set_ext_scan_param_sync function accesses a command skb after it has been freed. This can lead to potential crashes or code execution.

Defensive priority

High

Recommended defensive actions

• Review and apply the provided patches to the Linux kernel
• Ensure that the Linux kernel is updated to a version that includes the fix
• Monitor system logs for potential crashes or errors related to the Bluetooth hci_sync component
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.

Evidence notes

The vulnerability was reported by KASAN and affects the Linux kernel. Multiple source references are provided, including commit hashes for the fix. The issue arises during scan setup when the hci_le_set_ext_scan_param_sync function accesses a command skb after it has been freed. This can lead to potential crashes or code execution. Linux kernel developers and users of Linux-based systems with Bluetooth functionality should assess exposure and apply patches.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.