CVE-2026-98458

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: release unused CIS holds after channel attach

hci_bind_cis() and hci_connect_cis() return one hci_conn hold for the

ISO layer. A new channel association consumes that hold, which is

eventually released by iso_conn_free().

There are two cases where iso_chan_add() does not create an association:

it returns success when the socket is already attached to the same

iso_conn, and it returns -EBUSY when another socket is attached. The

hold returned for the current call is unused in both cases. This occurs

when deferred setup calls iso_connect_cis() again for its existing

socket, or when another socket attempts to reuse the CIS.

Detect the idempotent case while the connection is locked and release

the unused hold after iso_chan_add(). Also release it on -EBUSY. Do not

drop it for other errors: a newly allocated iso_conn releases the

transferred hold when its last temporary reference is put.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References