Cloudanix VulnDB

CVE-2026-98458

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in the Linux kernel's handling of certain Bluetooth connections can cause internal resources to leak, which may eventually interfere with Bluetooth device operation.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Failure to release an hci_conn reference count hold returned by hci_bind_cis() or hci_connect_cis() when iso_chan_add() returns success on an already-attached socket or -EBUSY for a conflicting socket, resulting in a leaked hold that is never consumed by iso_conn_free().

Why it matters to the business

Gradual exhaustion of Bluetooth connection resources on Linux systems using ISO channels, potentially causing degraded Bluetooth audio, device pairing failures, or system instability in environments with frequent deferred setups or socket reuse.

How an attack unfolds

An attacker with local or adjacent access triggers repeated calls to iso_connect_cis() on an existing socket or attempts CIS reuse by another socket while the connection is locked, causing the kernel to leak holds without creating an association; over time this accumulates until resource limits are hit.

How to fix it

Apply the upstream kernel patch that checks for the idempotent case under lock and releases the unused hold after iso_chan_add() as well as on -EBUSY; rebuild and deploy the fixed kernel version.

How to confirm the fix worked

Confirm the patch is present by inspecting the iso_chan_add() logic for explicit hold release on the already-attached and -EBUSY paths; test by exercising deferred ISO setup and socket-reuse scenarios and verifying no reference count growth occurs.

Typical attack path

  1. Gain access to a Linux system with Bluetooth ISO support enabled
  2. Establish or reuse ISO sockets to invoke iso_connect_cis() in deferred-setup or conflict scenarios
  3. Repeat attachment attempts to trigger idempotent success or -EBUSY paths without releasing holds
  4. Accumulate leaked hci_conn references until Bluetooth stack resources are exhausted

How to detect it

Review kernel logs for Bluetooth ISO attachment errors or repeated hci_connect_cis calls; inspect reference counts on hci_conn structures during active ISO sessions for unexpected growth without corresponding channel creation.

What your security team should do

  • Prioritize kernel updates on all systems exposing Bluetooth ISO functionality
  • Restrict Bluetooth usage to necessary devices and disable ISO channels when not required
  • Monitor kernel logs and connection counters for anomalous hci_conn reference growth

The record

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: release unused CIS holds after channel attach hci_bind_cis() and hci_connect_cis() return one hci_conn hold for the ISO layer. A new channel association consumes that hold, which is eventually released by iso_conn_free(). There are two cases where iso_chan_add() does not create an association: it returns success when the socket is already attached to the same iso_conn, and it returns -EBUSY when another socket is attached. The hold returned for the current call is unused in both cases. This occurs when deferred setup calls iso_connect_cis() again for its existing socket, or when another socket attempts to reuse the CIS. Detect the idempotent case while the connection is locked and release the unused hold after iso_chan_add(). Also release it on -EBUSY. Do not drop it for other errors: a newly allocated iso_conn releases the transferred hold when its last temporary reference is put.

Affected packages

Ecosystem Package Introduced Fixed