Cloudanix VulnDB

CVE-2026-98462

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A recent fix in the Linux kernel's Bluetooth handling prevents a memory management error that could occasionally crash devices or, in rare cases, be misused by attackers with local access.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Incorrect reference counting on CIS connections during reuse and error paths in the Bluetooth HCI layer leads to use-after-free conditions when hci_conn structures are accessed after their holds are dropped or not properly transferred.

Why it matters to the business

Low-probability kernel memory corruption on Linux systems with Bluetooth enabled could cause crashes or, in theory, allow local privilege escalation, though no public exploitation is known and the issue affects only a narrow Bluetooth ISO/CIS code path.

How an attack unfolds

An attacker would need to trigger repeated CIS bind and connect operations (via local Bluetooth stack interaction or a malicious peer device) that hit the unbalanced hold paths, causing a dangling hci_conn pointer to be dereferenced after free; the low EPSS and absence from KEV indicate this remains largely theoretical with no observed campaigns.

How to fix it

Update the Linux kernel to a version containing commit 69997d50ec57 and the follow-on fix that ensures holds are taken before any state-dependent return; monitor kernel changelogs for Bluetooth HCI patches released after 2026-10-18.

How to confirm the fix worked

Confirm the presence of the corrected hold logic in hci_bind_cis() and hci_connect_cis() by inspecting the kernel source or running a Bluetooth ISO connection test suite that exercises bind, connect, reuse, and error paths; verify no unbalanced hci_conn_drop() calls occur on configuration failure.

Typical attack path

  1. Obtain local access or pair a Bluetooth device capable of ISO/CIS traffic
  2. Trigger hci_bind_cis() and hci_connect_cis() sequences that exercise BT_BOUND/BT_CONNECTED or error paths
  3. Force reuse of an existing link via hci_conn_link() without additional hold acquisition
  4. Access the freed hci_conn structure through subsequent ISO layer operations
  5. Achieve memory corruption or crash

How to detect it

Inspect kernel logs for Bluetooth HCI oops or use-after-free warnings involving hci_conn or hci_bind_cis; correlate with unusual ISO socket activity or repeated CIS connection attempts from untrusted devices; no widespread exploitation artifacts have been published.

What your security team should do

  • Apply the referenced Bluetooth HCI fix in the next kernel update cycle given the 5-day publication window
  • Review Bluetooth-enabled systems for ISO/CIS usage and prioritize if they process untrusted peer connections
  • Monitor EPSS trend (stable at 0.002) and KEV status for any future elevation

The record

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: fix CIS hold ownership on reuse Commit 69997d50ec57 ("Bluetooth: ISO: handle bound CIS cleanup via hci_conn") made hci_bind_cis() and hci_connect_cis() return a connection with one hold for the ISO layer. hci_bind_cis() currently takes that hold only after configuring a CIS, so its BT_CONNECTED and matching BT_BOUND paths return a bare lookup result. Its configuration failure path can likewise call hci_conn_drop() before taking a hold. Take the hold before any state-dependent return or configuration error so every successful return follows the documented ownership contract and every error drop is balanced. hci_connect_cis() also assumes hci_conn_link() always takes a new CIS hold before dropping the one returned by hci_bind_cis(). However, the helper returns an existing link without taking another hold. In that case, preserve the CIS hold for the caller and drop the redundant LE hold because the existing link already owns its parent hold. Returning early also avoids changing an existing CIS back to BT_CONNECT.

Affected packages

Ecosystem Package Introduced Fixed