CVE-2026-98632

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel In send_cancel(), pending mesh_tx objects are removed from the hdev->mesh_pending list and freed via mesh_send_complete(). However, if a mesh transmission was already queued onto hdev->cmd_sync_work_list via mesh_next(), the queued entry retains a raw pointer to mesh_tx. When hci_cmd_sync_work later processes the entry, it attempts to execute mesh_send_sync and its destroy callback mesh_send_start_complete using the already freed mesh_tx pointer, leading to a use-after-free. Fix this by invoking hci_cmd_sync_dequeue() for mesh_send_sync on the target mesh_tx before completing it. If the entry is found and dequeued, its destroy callback will complete and free the object; otherwise, mesh_send_complete() is called directly. Additionally, ensure the transmission queue advances after cancellation or errors. In mesh_send_start_complete(), call mesh_next() on error unless err is -ECANCELED, because hci_cmd_sync_dequeue() holds hdev->cmd_sync_work_lock and calling mesh_next() synchronously would deadlock. Instead, advance the queue in send_cancel() once the lock is released and if no transmission is in progress.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

References

• https://git.kernel.org/stable/c/f84e52829021d00bca8e067302f597c71af1f71a ↗
• https://git.kernel.org/stable/c/718a8ffa180d469f99ad4f746f00cafd39456415 ↗
• https://git.kernel.org/stable/c/084be90948632a5a358821e687b11a14445aae76 ↗
• https://git.kernel.org/stable/c/2189a219397d8e73808a67c4aade837b635705da ↗
• https://git.kernel.org/stable/c/03ced4687fb79286be7fdee0fc58d2c74de3e7bb ↗
• https://git.kernel.org/stable/c/71af682ba4692c2ed9ace4c3d4ca462ae368c029 ↗