CVE-2026-98733

A race in the Bluetooth HCI ISO fragmented transmit path allows hci_queue_iso to update the packet queue without holding its lock while the transmit worker can dequeue and release the previous tail SKB. If the driver frees that SKB before insertion resumes, __skb_queue_tail can write through the stale tail pointer and cause a slab use after free or corrupt the queue. A local process can reach the affected path through iso_sock_sendmsg when fragmented ISO packets are queued while transmission is active. For the CVSS the PR:L value is selected because local code execution and access to a Bluetooth ISO socket are required, while full administrative privileges are not clearly required by the affected send path. AC:H reflects the timing dependent race between packet insertion, dequeue, and driver release. The issue is not directly network reachable because a remote Bluetooth peer cannot by itself invoke the local sendmsg path based on the available evidence. Impact is at least a local denial of service through a kernel crash and may include confidentiality or integrity impact because the stale pointer is used for a write into freed slab memory. The paranoid score uses C:H I:H A:H because a confirmed write use after free can potentially support privilege escalation if object reuse and race timing become controllable, but that escalation path is not demonstrated.