CVE-2026-98458Bluetooth: ISO: release unused CIS holds after channel attach
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: release unused CIS holds after channel attach hci_bind_cis() and hci_connect_cis() return one hci_conn hold for the ISO layer. A new channel association consumes that hold, which is eventually released by iso_conn_free(). There are two cases where iso_chan_add() does not create an association: it returns success when the socket is already attached to the same iso_conn, and it returns -EBUSY when another socket is attached. The hold returned for the current call is unused in both cases. This occurs when deferred setup calls iso_connect_cis() again for its existing socket, or when another socket attempts to reuse the CIS. Detect the idempotent case while the connection is locked and release the unused hold after iso_chan_add(). Also release it on -EBUSY. Do not drop it for other errors: a newly allocated iso_conn releases the transferred hold when its last temporary reference is put.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 18, 2026
- First seen by InfoSec Signals
- Oct 18, 2026
Affected products
Linux Linux linux:linux (from the name) | from 69997d50ec574be816b4ee8f9cee52ebbd53f8bd before e0e8b70207eaf27aee0a05ec5bf2d1b6bcb004d1; from 69997d50ec574be816b4ee8f9cee52ebbd53f8bd before ed4c026cc4094dfb7a329b9d8df0ddd0be1b2458; from 69997d50ec574be816b4ee8f9cee52ebbd53f8bd before e5fcca51177f224604e3a8c926ffd5edbeb58b09; 69997d50ec574be816b4ee8f9cee52ebbd53f8bd builds before 0fcd4dad555c96e0bd3a1b8c569f989be85c7341 | CNA record |
References
- https://git.kernel.org/stable/c/e0e8b70207eaf27aee0a05ec5bf2d1b6bcb004d1
- https://git.kernel.org/stable/c/ed4c026cc4094dfb7a329b9d8df0ddd0be1b2458
- https://git.kernel.org/stable/c/e5fcca51177f224604e3a8c926ffd5edbeb58b09
- https://git.kernel.org/stable/c/0fcd4dad555c96e0bd3a1b8c569f989be85c7341
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.