CVE-2026-98458

Full vulnerability record from the local CVENow database.

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: release unused CIS holds after channel attach hci_bind_cis() and hci_connect_cis() return one hci_conn hold for the ISO layer. A new channel association consumes that hold, which is eventually released by iso_conn_free(). There are two cases where iso_chan_add() does not create an association: it returns success when the socket is already attached to the same iso_conn, and it returns -EBUSY when another socket is attached. The hold returned for the current call is unused in both cases. This occurs when deferred setup calls iso_connect_cis() again for its existing socket, or when another socket attempts to reuse the CIS. Detect the idempotent case while the connection is locked and release the unused hold after iso_chan_add(). Also release it on -EBUSY. Do not drop it for other errors: a newly allocated iso_conn releases the transferred hold when its last temporary reference is put.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Received

Source identifier

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Published

2026-10-18 16:16:56.230000

Last modified

2026-10-19 10:18:55.257000

View original CVE JSON

{
  "id": "CVE-2026-98458",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2026-10-18T16:16:56.230",
  "lastModified": "2026-10-19T10:18:55.257",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: release unused CIS holds after channel attach\n\nhci_bind_cis() and hci_connect_cis() return one hci_conn hold for the\nISO layer.  A new channel association consumes that hold, which is\neventually released by iso_conn_free().\n\nThere are two cases where iso_chan_add() does not create an association:\nit returns success when the socket is already attached to the same\niso_conn, and it returns -EBUSY when another socket is attached.  The\nhold returned for the current call is unused in both cases.  This occurs\nwhen deferred setup calls iso_connect_cis() again for its existing\nsocket, or when another socket attempts to reuse the CIS.\n\nDetect the idempotent case while the connection is locked and release\nthe unused hold after iso_chan_add().  Also release it on -EBUSY.  Do not\ndrop it for other errors: a newly allocated iso_conn releases the\ntransferred hold when its last temporary reference is put."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "net/bluetooth/iso.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "69997d50ec574be816b4ee8f9cee52ebbd53f8bd",
              "lessThan": "e0e8b70207eaf27aee0a05ec5bf2d1b6bcb004d1",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "69997d50ec574be816b4ee8f9cee52ebbd53f8bd",
              "lessThan": "ed4c026cc4094dfb7a329b9d8df0ddd0be1b2458",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "69997d50ec574be816b4ee8f9cee52ebbd53f8bd",
              "lessThan": "e5fcca51177f224604e3a8c926ffd5edbeb58b09",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "69997d50ec574be816b4ee8f9cee52ebbd53f8bd",
              "lessThan": "0fcd4dad555c96e0bd3a1b8c569f989be85c7341",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "net/bluetooth/iso.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "6.6",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "6.6",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.12.113",
              "lessThanOrEqual": "6.12.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.18.55",
              "lessThanOrEqual": "6.18.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.2.9",
              "lessThanOrEqual": "7.2.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.3",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/0fcd4dad555c96e0bd3a1b8c569f989be85c7341",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e0e8b70207eaf27aee0a05ec5bf2d1b6bcb004d1",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e5fcca51177f224604e3a8c926ffd5edbeb58b09",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/ed4c026cc4094dfb7a329b9d8df0ddd0be1b2458",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}