CVE-2026-98459 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: ISO: balance the parent hold in hci_bind_bis()
hci_conn_link() takes a lifetime reference to its parent with hci_conn_get(), but only takes an operational hold on the child. hci_conn_unlink() later balances both a hold and a reference on the parent.
The SCO and CIS paths pass a parent acquired from a connect helper, so it already has a hold. For an additional BIS, hci_bind_bis() obtains the parent from hci_conn_hash_lookup_big(), which returns a bare pointer. Unlinking the child then drops the parent's existing hold and can schedule it for disconnection while its socket is still using it.
Take a hold on the parent before linking it and drop that hold if linking fails. A successful link transfers the hold to hci_conn_unlink().
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/18/2026
The identified vulnerability resides within the Linux kernel Bluetooth subsystem, specifically affecting the Isochronous Streams (ISO) implementation used for Connectionless ISO Data Channels such as Broadcast Audio Services. The core issue is a reference counting imbalance in the connection management logic, which can lead to premature object destruction and subsequent use-after-free conditions. In standard Bluetooth connection handling, functions like hci_conn_link() are designed to manage lifecycle references by taking a lifetime reference via hci_conn_get for the parent device while securing an operational hold on the child entity. This dual-reference model ensures that both the logical link structure and its underlying hardware context remain valid as long as they are in active use. The counterpart function, hci_conn_unlink(), is responsible for balancing these references by releasing both the operational hold and the lifetime reference when a connection is terminated or removed from the system.
The flaw emerges specifically within the Broadcast Isochronous Stream (BIS) binding path implemented in the hci_bind_bis() function. Unlike SCO and CIS connections, which retrieve their parent device pointer through connect helpers that already secure an appropriate hold on the HCI device structure, BIS connections utilize hci_conn_hash_lookup_big(). This lookup function returns a bare pointer to the existing connection object without incrementing its reference count or securing any additional holds. Consequently, when this unrefcounted pointer is passed into the linking logic and subsequently used in unlink operations, the system incorrectly assumes that a valid hold exists on the parent device. If hci_bind_bis() proceeds with linking using this bare pointer, the subsequent call to hci_conn_unlink() will decrement reference counts based on the assumption of an existing hold. Since no such hold was actually acquired for BIS connections in this specific code path, the refcount may drop below zero or reach zero prematurely, triggering immediate cleanup routines even while active sockets are still referencing the connection structure.
This reference counting error results in a critical use-after-free vulnerability that can be exploited to cause kernel crashes, denial of service, or potentially arbitrary code execution if an attacker can manipulate memory layout through heap spraying techniques following the premature deallocation. The operational impact is severe because it allows for the scheduling of disconnection and resource release while user-space sockets are still actively using the connection context. This race condition between socket usage and kernel-side cleanup creates a window where dangling pointers are accessed, violating memory safety guarantees inherent to the Linux kernel security model. Such vulnerabilities undermine system stability and can lead to privilege escalation if exploited in conjunction with other local attack vectors that allow an unprivileged user to trigger Bluetooth ISO stream bindings.
To mitigate this vulnerability, developers must ensure strict adherence to reference counting protocols for all connection objects regardless of their type or creation path. The primary fix involves modifying hci_bind_bis() to explicitly acquire a hold on the parent device using hci_conn_get before attempting to link it with the new BIS instance. This acquired hold ensures that the parent structure remains valid throughout the lifetime of the binding operation. Furthermore, error handling paths within this function must be updated to drop this additional hold if the linking process fails, preventing reference leaks in failure scenarios. Upon successful linkage, the responsibility for dropping the hold is transferred to hci_conn_unlink(), maintaining symmetry with other connection types like SCO and CIS. This correction aligns the BIS implementation with established kernel memory management standards and prevents premature object destruction.
From a classification perspective, this vulnerability corresponds to CWE-416, Use After Free, as it involves accessing memory after it has been freed due to incorrect reference counting. It also relates to CWE-755, Improper Handling of Exceptional Conditions, specifically regarding the failure to properly manage resource lifecycles in error paths or specific code branches that deviate from standard patterns. In terms of adversarial tactics, this flaw could be leveraged within ATT&CK technique T1068, Exploitation for Privilege Escalation, if an attacker can trigger the condition locally to gain higher privileges via kernel memory corruption. Security practitioners should prioritize applying kernel patches that address Bluetooth reference counting logic and monitor for anomalies in system stability related to high-frequency Bluetooth ISO stream operations. Regular auditing of connection management code paths against established lifecycle models is essential to prevent similar discrepancies in other subsystems where bare pointers are returned from hash lookups without corresponding refcount increments.