CVE-2026-98458 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: ISO: release unused CIS holds after channel attach
hci_bind_cis() and hci_connect_cis() return one hci_conn hold for the ISO layer. A new channel association consumes that hold, which is eventually released by iso_conn_free().
There are two cases where iso_chan_add() does not create an association: it returns success when the socket is already attached to the same iso_conn, and it returns -EBUSY when another socket is attached. The hold returned for the current call is unused in both cases. This occurs when deferred setup calls iso_connect_cis() again for its existing socket, or when another socket attempts to reuse the CIS.
Detect the idempotent case while the connection is locked and release the unused hold after iso_chan_add(). Also release it on -EBUSY. Do not drop it for other errors: a newly allocated iso_conn releases the transferred hold when its last temporary reference is put.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/18/2026
The Linux kernel Bluetooth subsystem contains an implementation flaw within the Isochronous Channels (ISO) management logic that results in resource leaks due to improper handling of connection object references. Specifically, the functions hci_bind_cis and hci_connect_cis are designed to return a reference hold for the HCI connection structure to the ISO layer upon successful initiation or binding operations. This mechanism ensures that the underlying connection remains active while associated with an ISO channel. However, the current implementation fails to account for scenarios where iso_chan_add does not establish a new association between the socket and the connection object. In these specific edge cases, the reference hold acquired by the caller is never released, leading to a persistent memory leak within the kernel space that can eventually exhaust available resources if triggered repeatedly.
The vulnerability manifests in two distinct operational states involving the iso_chan_add function. The first case occurs when an application attempts to attach a socket to an ISO connection object that it has already attached previously. In this idempotent scenario, the system recognizes the existing attachment and returns success without creating a new association structure. Despite returning success, the caller retains the reference hold obtained from hci_connect_cis or hci_bind_cis, which is now redundant because no new structural link was formed to consume it. The second case arises when another socket has already established an exclusive attachment to the same CIS connection object. In this conflict scenario, iso_chan_add returns a -EBUSY error code to indicate that the resource is unavailable for reuse by multiple sockets simultaneously. Even in this failure path, the initial reference hold acquired during the setup phase remains unreleased because the standard cleanup routine associated with successful channel creation is bypassed due to the early return on error.
This improper reference counting constitutes a classic use-after-free or memory leak vulnerability depending on how long the leaked references persist before system reboot or module unload. While immediate exploitation for arbitrary code execution is unlikely, sustained resource exhaustion can lead to denial of service conditions by depleting kernel memory pools associated with Bluetooth HCI connections. Over time, as new connection attempts are made without proper cleanup, the accumulation of unreleased hci_conn structures increases memory pressure on the system. This aligns with CWE-401, which describes a missing release of memory after effective use in its allocated space, and falls under ATT&CK technique T1529 for resource exhaustion within operating systems. The flaw highlights a gap in error handling logic where success paths that do not result in structural changes are treated identically to successful new associations regarding reference management.
The resolution involves modifying the iso_chan_add function to detect these specific conditions while holding the connection lock, ensuring thread safety during the check and release process. For the idempotent case where a socket is already attached to the same ISO connection, the code now explicitly releases the unused hold immediately after detecting that no new association was created. Similarly, in the -EBUSY scenario where another socket holds priority for the CIS, the function also releases the reference before returning the error code. Crucially, the fix preserves correct behavior for other types of errors by not dropping the hold prematurely; this is because newly allocated ISO connection objects are designed to release their transferred holds automatically when their last temporary reference count reaches zero during final cleanup via iso_conn_free. This targeted approach ensures that references are only released when they are truly no longer needed, maintaining system stability and preventing memory leaks without introducing new race conditions or premature deallocation risks.