CVE-2026-98459

Received Received - Intake

Bluetooth Use-After-Free in Linux Kernel

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: balance the parent hold in hci_bind_bis() hci_conn_link() takes a lifetime reference to its parent with hci_conn_get(), but only takes an operational hold on the child. hci_conn_unlink() later balances both a hold and a reference on the parent. The SCO and CIS paths pass a parent acquired from a connect helper, so it already has a hold. For an additional BIS, hci_bind_bis() obtains the parent from hci_conn_hash_lookup_big(), which returns a bare pointer. Unlinking the child then drops the parent's existing hold and can schedule it for disconnection while its socket is still using it. Take a hold on the parent before linking it and drop that hold if linking fails. A successful link transfers the hold to hci_conn_unlink().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98459

EUVD

EUVD-2026-103699

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	11dc486ed5d4626e6b92a23b67ed76cb6c48bfc9
Linux	Linux	fa224d0c094a458e9ebf5ea9b1c696136b7af427
Linux	Linux	fa224d0c094a458e9ebf5ea9b1c696136b7af427
Linux	Linux	fa224d0c094a458e9ebf5ea9b1c696136b7af427
Linux	Linux	fa224d0c094a458e9ebf5ea9b1c696136b7af427
Linux	Linux	6.6.67
Linux	Linux	6.8

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel Bluetooth vulnerability where a reference counting issue in the ISO (isochronous) connection handling can lead to premature disconnection of a parent Bluetooth connection while its child socket is still in use. The flaw occurs in hci_bind_bis() when it acquires a parent connection without proper reference management, causing the parent to be scheduled for disconnection while its child remains active.

Detection Guidance

This vulnerability is specific to the Linux kernel's Bluetooth ISO implementation and requires kernel-level inspection. There are no direct network or system commands to detect it as it involves a reference counting issue in the kernel's Bluetooth stack. Monitoring kernel logs for Bluetooth-related crashes or disconnections may indicate exploitation or instability.

Impact Analysis

This vulnerability could cause Bluetooth audio or data streaming to fail unexpectedly. If exploited, it may lead to dropped connections, audio glitches, or data corruption during active Bluetooth sessions, particularly for isochronous connections like audio streaming.

Compliance Impact

This vulnerability affects Bluetooth ISO functionality in the Linux kernel and could lead to improper resource management, potentially causing denial-of-service conditions. While it does not directly impact GDPR or HIPAA compliance, such vulnerabilities may affect systems handling sensitive data by disrupting secure communications or services, indirectly influencing compliance if critical security controls are compromised.

Mitigation Strategies

Apply the latest Linux kernel security patches to address the Bluetooth ISO vulnerability. Monitor kernel updates from your distribution vendor and update systems accordingly.

Hi! I’m here to help you understand CVE-2026-98459. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70