CVE-2026-98293

In the Linux kernel’s Bluetooth ISO subsystem, a parent socket reference is held when creating a child socket. If the child fails to allocate, the error path calls only release_sock(), leaving the parent reference unreleased. Each failure leaks a reference to the parent socket, gradually consuming kernel memory until the system can become unstable or unresponsive, potentially resulting in a denial of service. The flaw does not provide arbitrary code execution or privilege escalation; its primary impact is availability degradation through resource exhaustion. Based on the description, it is inferred that exploitation requires an attacker to repeatedly trigger the child socket allocation failure via Bluetooth ISO connections, either locally or remotely, causing the cumulative leak.

All Linux kernel versions that include the Bluetooth ISO implementation before the fix commit are vulnerable. The advisory lists no specific kernel releases, meaning any distribution shipping an older kernel that has not incorporated the commit that drops the reference is at risk. The affected product is the Linux kernel itself, and any distribution using that kernel is impacted.

The EPSS score is below 1%, and the vulnerability is not listed in CISA’s KEV catalog, indicating limited publicly known exploitation. The CVSS score of 5.5 reflects moderate severity. Based on the description, it is inferred that exploitation requires an attacker to repeatedly trigger the child socket allocation failure via Bluetooth ISO connections, either locally or remotely, causing the cumulative leak. The overall risk is moderate, centered around availability through kernel memory exhaustion.