{"id":"CVE-2026-98459","kind":"vulnerability","aliases":["CVE-2026-98459"],"related":[],"title":"Linux kernel Bluetooth ISO: parent connection can be dropped while in use","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: balance the parent hold in hci_bind_bis()\n\nhci_conn_link() takes a lifetime reference to its parent with\nhci_conn_get(), but only takes an operational hold on the child.\nhci_conn_unlink() later balances both a hold and a reference on the\nparent.\n\nThe SCO and CIS paths pass a parent acquired from a connect helper, so\nit already has a hold. For an additional BIS, hci_bind_bis() obtains the\nparent from hci_conn_hash_lookup_big(), which returns a bare pointer.\nUnlinking the child then drops the parent's existing hold and can\nschedule it for disconnection while its socket is still using it.\n\nTake a hold on the parent before linking it and drop that hold if linking\nfails. A successful link transfers the hold to hci_conn_unlink().","summary":"In the Linux kernel's Bluetooth ISO code, adding a BIS link does not take its own hold on the parent connection, so unlinking a child can drop the parent's hold and schedule it for disconnection while a socket still uses it. The sources do not state what an attacker can do beyond this use-after-release style disruption.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bluetooth","linux-kernel","other"],"not_affected_if":["no-bluetooth-iso"],"how_to_check":"- unknown","fix":"- Apply the upstream Linux kernel fix that takes a hold on the parent in hci_bind_bis(), referenced in the NVD entry for CVE-2026-98459.","status":"open","published_at":"2026-10-18T16:16:56+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:27:15+00:00","updated_at":"2026-10-25T05:27:15+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-10-25T05:27:15Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the upstream Linux kernel fix that takes a hold on the parent in hci_bind_bis(), referenced in the NVD entry for CVE-2026-98459.","reach":"local","title":"Linux kernel Bluetooth ISO: parent connection can be dropped while in use","impact":"medium","summary":"In the Linux kernel's Bluetooth ISO code, adding a BIS link does not take its own hold on the parent connection, so unlinking a child can drop the parent's hold and schedule it for disconnection while a socket still uses it. The sources do not state what an attacker can do beyond this use-after-release style disruption.","category":"other","nicknames":[],"who_cares":["linux-kernel","bluetooth"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown, sources do not describe the impact beyond connection teardown while in use","analyst_note":"Check the NVD entry and the upstream kernel commit for affected version ranges, exploitability and a severity score.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-bluetooth-iso"],"who_is_affected":"Systems running a Linux kernel with Bluetooth ISO support that use BIS (broadcast isochronous) connections. The sources do not say which kernel versions are affected or whether a default configuration is exposed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000605,"input_tokens":3513,"output_tokens":507,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-98459':15A,18A 'acquir':149C 'add':31B 'addit':162C 'alreadi':156C 'attack':73B 'balanc':96C,131C 'bare':179C 'beyond':76B 'big':175C 'bind':102C,165C 'bis':33B,103C,163C,166C 'bluetooth':3A,19B,28B,94C 'child':48B,126C,183C 'cis':144C 'code':30B 'conn':105C,116C,128C,172C,228C 'connect':6A,44B,152C 'cve':13A,16A 'disconnect':59B,196C 'disrupt':83B 'drop':9A,50B,185C,214C 'exist':189C 'fail':219C 'follow':89C 'get':117C 'hash':173C 'hci':101C,104C,115C,127C,164C,171C,227C 'helper':153C 'hold':40B,54B,99C,123C,134C,159C,190C,206C,216C,225C 'iso':4A,29B,95C 'kernel':2A,22B,26B,87C 'later':130C 'lifetim':109C 'link':34B,106C,211C,218C,222C 'linux':1A,21B,25B,86C 'linux-kernel':20B 'lookup':174C 'obtain':167C 'oper':122C 'parent':5A,43B,52B,98C,113C,140C,148C,169C,187C,209C 'pass':146C 'path':145C 'pointer':180C 'refer':110C,137C 'releas':81B 'resolv':93C 'return':177C 'schedul':56B,193C 'sco':142C 'socket':62B,199C 'sourc':67B 'state':70B 'still':63B,201C 'style':82B 'success':221C 'take':37B,107C,120C,204C 'transfer':223C 'unlink':46B,129C,181C,229C 'use':12A,64B,79B,202C 'use-after-releas':78B 'vulner':90C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with Bluetooth ISO support that use BIS (broadcast isochronous) connections. The sources do not say which kernel versions are affected or whether a default configuration is exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:16:56+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98459","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98459","severity":null,"published_at":"2026-10-18T16:16:56+00:00","modified_at":"2026-10-19T10:18:55+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}