Cloudanix VulnDB

CVE-2026-98459

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel's handling of certain Bluetooth wireless connections could let an attacker on the same network crash the system or potentially run code.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Reference counting imbalance in hci_conn_link/hci_conn_unlink for ISO BIS connections causes the parent hci_conn to be freed while a child socket still holds a reference, resulting in use-after-free.

Why it matters to the business

Kernel instability or potential code execution on Bluetooth-enabled Linux systems may disrupt wireless audio, headsets, or IoT devices and require emergency patching across fleets.

How an attack unfolds

An attacker with local or adjacent access repeatedly binds additional BIS connections via hci_bind_bis, triggering premature parent disconnection while the socket layer still uses the freed object.

How to fix it

Apply the upstream fix that adds an explicit hold on the parent before linking and drops it on failure; upgrade to a kernel containing the resolved Bluetooth ISO reference handling.

How to confirm the fix worked

Confirm the presence of the balancing hci_conn_get call in hci_bind_bis and verify that hci_conn_unlink no longer frees an in-use parent under concurrent BIS binding.

Typical attack path

  1. Obtain local or Bluetooth-adjacent access to the target
  2. Trigger repeated hci_bind_bis calls against an existing BIG
  3. Force hci_conn_unlink to drop the final parent reference
  4. Reuse the freed hci_conn object via in-flight socket operations

How to detect it

Review kernel logs for Bluetooth ISO and hci_conn reference warnings or use-after-free oops traces; correlate with processes performing repeated BIS socket binds.

What your security team should do

  • Prioritize kernel updates on all Bluetooth-enabled hosts within the next maintenance window
  • Disable ISO socket support via kernel config if Bluetooth audio is not required
  • Monitor kernel logs for hci_conn and Bluetooth ISO related warnings or crashes

The record

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: balance the parent hold in hci_bind_bis() hci_conn_link() takes a lifetime reference to its parent with hci_conn_get(), but only takes an operational hold on the child. hci_conn_unlink() later balances both a hold and a reference on the parent. The SCO and CIS paths pass a parent acquired from a connect helper, so it already has a hold. For an additional BIS, hci_bind_bis() obtains the parent from hci_conn_hash_lookup_big(), which returns a bare pointer. Unlinking the child then drops the parent's existing hold and can schedule it for disconnection while its socket is still using it. Take a hold on the parent before linking it and drop that hold if linking fails. A successful link transfers the hold to hci_conn_unlink().

Affected packages

Ecosystem Package Introduced Fixed