{"id":"AZL-108921","summary":"CVE-2026-98632 affecting package kernel 6.6.157.1-1","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel\n\nIn send_cancel(), pending mesh_tx objects are removed from the\nhdev-\u003emesh_pending list and freed via mesh_send_complete().  However, if\na mesh transmission was already queued onto hdev-\u003ecmd_sync_work_list via\nmesh_next(), the queued entry retains a raw pointer to mesh_tx.\n\nWhen hci_cmd_sync_work later processes the entry, it attempts to execute\nmesh_send_sync and its destroy callback mesh_send_start_complete using\nthe already freed mesh_tx pointer, leading to a use-after-free.\n\nFix this by invoking hci_cmd_sync_dequeue() for mesh_send_sync on the\ntarget mesh_tx before completing it.  If the entry is found and dequeued,\nits destroy callback will complete and free the object; otherwise,\nmesh_send_complete() is called directly.\n\nAdditionally, ensure the transmission queue advances after cancellation\nor errors.  In mesh_send_start_complete(), call mesh_next() on error\nunless err is -ECANCELED, because hci_cmd_sync_dequeue() holds\nhdev-\u003ecmd_sync_work_lock and calling mesh_next() synchronously would\ndeadlock.  Instead, advance the queue in send_cancel() once the lock is\nreleased and if no transmission is in progress.","modified":"2026-10-19T14:16:49.611444402Z","published":"2026-10-18T16:17:16Z","upstream":["CVE-2026-98632"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98632"}],"affected":[{"package":{"name":"kernel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.6.157.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-108921.json"}}],"schema_version":"1.9.0"}