CVE-2026-98462 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_conn: fix CIS hold ownership on reuse
Commit 69997d50ec57 ("Bluetooth: ISO: handle bound CIS cleanup via hci_conn") made hci_bind_cis() and hci_connect_cis() return a connection with one hold for the ISO layer. hci_bind_cis() currently takes that hold only after configuring a CIS, so its BT_CONNECTED and matching BT_BOUND paths return a bare lookup result. Its configuration failure path can likewise call hci_conn_drop() before taking a hold.
Take the hold before any state-dependent return or configuration error so every successful return follows the documented ownership contract and every error drop is balanced.
hci_connect_cis() also assumes hci_conn_link() always takes a new CIS hold before dropping the one returned by hci_bind_cis(). However, the helper returns an existing link without taking another hold. In that case, preserve the CIS hold for the caller and drop the redundant LE hold because the existing link already owns its parent hold. Returning early also avoids changing an existing CIS back to BT_CONNECT.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/18/2026
The Linux kernel Bluetooth subsystem contains a reference counting flaw within the Connection-Oriented Stream (CIS) connection management logic, specifically affecting the hci_bind_cis and hci_connect_cis functions. This vulnerability stems from inconsistent ownership semantics regarding how connection objects are held by different layers of the stack. The ISO layer expects to receive a valid CIS handle with an associated reference count that ensures the object remains alive for its duration of use. However, prior to this fix, certain code paths in hci_bind_cis returned bare lookup results without incrementing the hold counter when specific state conditions were met, such as when the connection was already bound or connected. This discrepancy violates the documented ownership contract where every successful return should carry a reference that balances subsequent drops.
The technical flaw manifests primarily through two distinct failure modes within the CIS binding and creation process. First, in hci_bind_cis, if the configuration fails after an initial lookup but before taking a hold, or if the connection is already in BT_CONNECTED or BT_BOUND states, the function returns without incrementing the reference count. This leads to scenarios where the caller receives a pointer to a kernel object that it does not own, potentially leading to premature deallocation if other references are dropped elsewhere. Second, hci_connect_cis assumes that linking a new CIS will always take an additional hold over the one returned by binding. When reusing an existing link rather than creating a new one, this assumption fails because no new hold is taken for the ISO layer while the redundant LE hold might be managed incorrectly. This imbalance can result in either use-after-free vulnerabilities if the object is freed too early or memory leaks if holds are not properly balanced during error paths.
From an operational impact perspective, these reference counting errors pose significant risks to system stability and security. A premature drop of a CIS handle due to missing holds could allow attackers with local access to trigger race conditions that lead to kernel panics or denial of service by freeing active connection structures while they are still in use. Conversely, failure to properly balance drops during error handling paths can result in memory leaks, gradually exhausting system resources and degrading performance over time. These issues undermine the reliability of Bluetooth Low Energy (LE) audio streams which rely on CIS for synchronous connections, potentially disrupting real-time data transmission and causing unpredictable behavior in devices dependent on stable kernel-level networking stacks.
Mitigation strategies involve applying the upstream Linux kernel patch that corrects these reference counting semantics. The fix ensures that hci_bind_cis takes a hold before any state-dependent return or configuration error path is executed, guaranteeing that every successful return adheres to the ownership contract and that all error paths properly balance their drops. Additionally, hci_connect_cis has been updated to preserve the CIS hold for the caller when reusing an existing link while correctly dropping redundant LE holds since the parent already owns its reference. Administrators should update their kernel versions to include this commit to restore proper resource management within the Bluetooth ISO subsystem and prevent potential exploitation of these race conditions or memory safety violations.
This vulnerability aligns with CWE-416, Use After Free, as improper handling of object lifecycles can lead to accessing freed memory. It also relates to CWE-755, Improper Handling of Exceptional Conditions, due to the failure in managing resource cleanup during error states within hci_bind_cis. In terms of ATT&CK mapping, this type of kernel-level reference counting flaw is often leveraged for privilege escalation or denial of service attacks by local attackers seeking to destabilize the operating system environment through crafted Bluetooth stack interactions.