{"id":"CVE-2026-98458","kind":"vulnerability","aliases":["CVE-2026-98458"],"related":[],"title":"Linux kernel: Bluetooth CIS connection leaks an unused reference hold","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: release unused CIS holds after channel attach\n\nhci_bind_cis() and hci_connect_cis() return one hci_conn hold for the\nISO layer.  A new channel association consumes that hold, which is\neventually released by iso_conn_free().\n\nThere are two cases where iso_chan_add() does not create an association:\nit returns success when the socket is already attached to the same\niso_conn, and it returns -EBUSY when another socket is attached.  The\nhold returned for the current call is unused in both cases.  This occurs\nwhen deferred setup calls iso_connect_cis() again for its existing\nsocket, or when another socket attempts to reuse the CIS.\n\nDetect the idempotent case while the connection is locked and release\nthe unused hold after iso_chan_add().  Also release it on -EBUSY.  Do not\ndrop it for other errors: a newly allocated iso_conn releases the\ntransferred hold when its last temporary reference is put.","summary":"The Linux kernel's Bluetooth ISO layer keeps an extra connection reference when a socket re-requests a CIS it already holds, or when another socket tries to reuse one, so the reference is never released. The sources describe a resource leak and do not state an attacker-controlled impact.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bluetooth","linux-kernel","runtime","self-hosted"],"not_affected_if":["bluetooth-disabled","no-bluetooth-iso"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-18T16:16:56+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:27:17+00:00","updated_at":"2026-10-25T05:27:17+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-25T05:27:17Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: Bluetooth CIS connection leaks an unused reference hold","impact":"low","summary":"The Linux kernel's Bluetooth ISO layer keeps an extra connection reference when a socket re-requests a CIS it already holds, or when another socket tries to reuse one, so the reference is never released. The sources describe a resource leak and do not state an attacker-controlled impact.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","bluetooth","self-hosted"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; the sources describe a reference leak only","analyst_note":"Check the NVD entry and the upstream kernel stable commit for affected and fixed kernel versions and the real security impact of the reference leak.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["bluetooth-disabled","no-bluetooth-iso"],"who_is_affected":"Systems running a Linux kernel with Bluetooth LE Isochronous channel (CIS) support in the affected range; the sources do not list affected kernel versions. Systems without Bluetooth ISO use, or with Bluetooth disabled, are unlikely to be exposed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000595,"input_tokens":3550,"output_tokens":480,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-98458':13A,16A 'add':134C,215C 'alloc':230C 'alreadi':46B,147C 'also':216C 'anoth':50B,159C,191C 'associ':115C,139C 'attach':95C,148C,162C 'attack':74B 'attacker-control':73B 'attempt':193C 'bind':97C 'bluetooth':3A,17B,29B,87C 'call':169C,180C 'case':130C,174C,201C 'chan':133C,214C 'channel':94C,114C 'cis':4A,44B,91C,98C,102C,183C,197C 'conn':106C,125C,153C,232C 'connect':5A,35B,101C,182C,204C 'consum':116C 'control':75B 'creat':137C 'current':168C 'cve':11A,14A 'defer':178C 'describ':64B 'detect':198C 'drop':223C 'ebusi':157C,220C 'error':227C 'eventu':121C 'exist':187C 'extra':34B 'follow':82C 'free':126C 'hci':96C,100C,105C 'hold':10A,47B,92C,107C,118C,164C,211C,236C 'host':24B 'idempot':200C 'impact':76B 'iso':30B,88C,110C,124C,132C,152C,181C,213C,231C 'keep':32B 'kernel':2A,20B,27B,80C 'last':239C 'layer':31B,111C 'leak':6A,67B 'linux':1A,19B,26B,79C 'linux-kernel':18B 'lock':206C 'never':60B 'new':113C 'newli':229C 'occur':176C 'one':55B,104C 'put':243C 're':41B 're-request':40B 'refer':9A,36B,58B,241C 'releas':61B,89C,122C,208C,217C,233C 'request':42B 'resolv':86C 'resourc':66B 'return':103C,141C,156C,165C 'reus':54B,195C 'runtim':21B 'self':23B 'self-host':22B 'setup':179C 'socket':39B,51B,145C,160C,188C,192C 'sourc':63B 'state':71B 'success':142C 'temporari':240C 'transfer':235C 'tri':52B 'two':129C 'unus':8A,90C,171C,210C 'vulner':83C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with Bluetooth LE Isochronous channel (CIS) support in the affected range; the sources do not list affected kernel versions. Systems without Bluetooth ISO use, or with Bluetooth disabled, are unlikely to be exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:16:56+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98458","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98458","severity":null,"published_at":"2026-10-18T16:16:56+00:00","modified_at":"2026-10-19T10:18:55+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}