CVE-2026-98458
Received Received - Intake

Bluetooth ISO Connection Hold Leak in Linux Kernel

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: release unused CIS holds after channel attach hci_bind_cis() and hci_connect_cis() return one hci_conn hold for the ISO layer. A new channel association consumes that hold, which is eventually released by iso_conn_free(). There are two cases where iso_chan_add() does not create an association: it returns success when the socket is already attached to the same iso_conn, and it returns -EBUSY when another socket is attached. The hold returned for the current call is unused in both cases. This occurs when deferred setup calls iso_connect_cis() again for its existing socket, or when another socket attempts to reuse the CIS. Detect the idempotent case while the connection is locked and release the unused hold after iso_chan_add(). Also release it on -EBUSY. Do not drop it for other errors: a newly allocated iso_conn releases the transferred hold when its last temporary reference is put.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98458
EUVD
EUVD-2026-103698

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
Linux Linux 69997d50ec574be816b4ee8f9cee52ebbd53f8bd
Linux Linux 69997d50ec574be816b4ee8f9cee52ebbd53f8bd
Linux Linux 69997d50ec574be816b4ee8f9cee52ebbd53f8bd
Linux Linux 69997d50ec574be816b4ee8f9cee52ebbd53f8bd
Linux Linux 6.6

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves Bluetooth ISO (isochronous) connections. When a Bluetooth ISO channel is attached to a connection, the system holds a reference to manage the connection. However, if the channel is already attached or another socket tries to reuse it, the system fails to release this unused hold properly. This can lead to resource leaks where the hold remains allocated unnecessarily.

Detection Guidance

This vulnerability is specific to the Linux kernel's Bluetooth ISO layer and does not have direct network detection methods. Monitor kernel logs for Bluetooth-related errors or warnings using commands like 'dmesg | grep -i bluetooth' or 'journalctl -k | grep -i bluetooth'. Check for unusual Bluetooth connection attempts or failures.

Impact Analysis

This vulnerability could cause resource exhaustion in the Linux kernel, particularly affecting Bluetooth ISO connections. It may lead to system instability, crashes, or degraded performance if the leaked holds accumulate over time. Users relying on Bluetooth devices or services could experience disruptions.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this vulnerability. If immediate patching is not possible, consider disabling Bluetooth ISO functionality temporarily if it is not required for your system.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98458. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart