Live › vulnerability › CVE-2026-98459
Go to dashboardIn the Linux kernel's Bluetooth ISO code, adding a BIS link does not take its own hold on the parent connection, so unlinking a child can drop the parent's hold and schedule it for disconnection while a socket still uses it. The sources do not state what an attacker can do beyond this use-after-release style disruption.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel with Bluetooth ISO support that use BIS (broadcast isochronous) connections. The sources do not say which kernel versions are affected or whether a default configuration is exposed.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: ISO: balance the parent hold in hci_bind_bis()
hci_conn_link() takes a lifetime reference to its parent with hci_conn_get(), but only takes an operational hold on the child. hci_conn_unlink() later balances both a hold and a reference on the parent.
The SCO and CIS paths pass a parent acquired from a connect helper, so it already has a hold. For an additional BIS, hci_bind_bis() obtains the parent from hci_conn_hash_lookup_big(), which returns a bare pointer. Unlinking the child then drops the parent's existing hold and can schedule it for disconnection while its socket is still using it.
Take a hold on the parent before linking it and drop that hold if linking fails. A successful link transfers the hold to hci_conn_unlink().
This page as .md · .json · in your agent: get_signal("CVE-2026-98459")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.