Cloudanix VulnDB

CVE-2026-98293

None

CVSS

—

EPSS

0.2%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A small mistake in the Linux Bluetooth code can slowly leak memory when certain connections fail, eventually making devices run out of resources if left unpatched.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Missing sock_put() call on error path after iso_get_sock() in iso_conn_ready() leaks a reference to the parent Bluetooth ISO socket when iso_sock_alloc() fails.

Why it matters to the business

Over time, repeated failed ISO connection attempts can exhaust kernel memory on Bluetooth-enabled Linux systems, leading to degraded performance or service disruption in affected devices.

How an attack unfolds

An attacker initiates Bluetooth ISO connection attempts that trigger the error path in iso_conn_ready() by causing iso_sock_alloc() to fail, leaving the parent socket reference unreleased; repeated triggering accumulates leaks until memory pressure occurs.

How to fix it

Update the Linux kernel to a version containing the fix that adds sock_put() on the iso_sock_alloc() failure path in iso_conn_ready(); rebuild and deploy the patched kernel across affected systems.

How to confirm the fix worked

Inspect the iso_conn_ready() function in the kernel Bluetooth ISO source to confirm presence of sock_put() on the iso_sock_alloc() error path; verify running kernel version includes the commit resolving the reference leak.

Typical attack path

  1. Establish conditions for repeated ISO socket connection setup attempts over Bluetooth
  2. Force iso_sock_alloc() to fail during iso_conn_ready() processing
  3. Trigger the incomplete error path that omits sock_put() on the parent socket
  4. Repeat to accumulate unreleased socket references and exhaust memory

How to detect it

Monitor for steadily increasing kernel socket or slab memory usage correlated with Bluetooth ISO activity; inspect kernel logs for repeated iso_conn_ready or iso_sock_alloc failures and use memory accounting tools to track unreleased ISO parent sockets.

What your security team should do

  • Apply the upstream kernel fix to all Bluetooth-enabled systems within the next patch cycle
  • Monitor kernel memory usage and socket counts on systems exposing Bluetooth ISO
  • Disable Bluetooth ISO support where not required until patched
  • Review and test kernel updates in staging environments before production deployment

The record

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix parent socket leak in iso_conn_ready() iso_get_sock() returns the parent socket with a reference held, which is dropped by sock_put() once the child socket has been set up. The error path taken when iso_sock_alloc() fails only calls release_sock() and returns, leaking the reference and thus the parent socket itself. Drop the reference on that path as well.

Affected packages

Ecosystem Package Introduced Fixed