CVE-2026-98459 - Vulnerability Details

- Bluetooth: ISO: balance the parent hold in hci_bind_bis()

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: balance the parent hold in hci_bind_bis()

hci_conn_link() takes a lifetime reference to its parent with
hci_conn_get(), but only takes an operational hold on the child.
hci_conn_unlink() later balances both a hold and a reference on the
parent.

The SCO and CIS paths pass a parent acquired from a connect helper, so
it already has a hold. For an additional BIS, hci_bind_bis() obtains the
parent from hci_conn_hash_lookup_big(), which returns a bare pointer.
Unlinking the child then drops the parent's existing hold and can
schedule it for disconnection while its socket is still using it.

Take a hold on the parent before linking it and drop that hold if linking
fails. A successful link transfers the hold to hci_conn_unlink().

Published: 2026-10-18

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability arises from a reference‑counting bug in the Linux kernel's Bluetooth ISO subsystem. During a bind operation, the parent connection receives only a hold that is dropped prematurely when a child fails to link, potentially causing the parent to be disconnected while its socket remains open. This can lead to service interruption or a kernel crash, satisfying the definition of a denial‑of‑service flaw (CWE‑911).

Affected Systems

All Linux kernels that include Bluetooth ISO support and lack the commit identified in the advisory are affected. The flaw exists in any kernel before the commit that adds a hold on the parent before linking. Administrators should verify that their running kernel contains the "balance parent hold" change or upgrade to a kernel version that includes it.

Risk and Exploitability

The CVSS score of 5.5 reflects moderate severity, while the EPSS score of <1% indicates a very low likelihood of exploitation. The flaw is not listed in the CISA KEV catalog. Attackers would need to initiate or manipulate Bluetooth ISO connections to trigger a failed link and force the parent disconnect; this likely requires unauthenticated or remote access to the Bluetooth stack.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`11dc486ed5d4626e6b92a23b67ed76cb6c48bfc9`	affected	< ff28e6c67143c76ef50c3eac01f2fad411705f71
`fa224d0c094a458e9ebf5ea9b1c696136b7af427`	affected	< 03a91cdf6862fb351a74f035ad21e70112438552
`fa224d0c094a458e9ebf5ea9b1c696136b7af427`	affected	< 4e49206d9574a4c109480198e73aea34ad0ed7f6
`fa224d0c094a458e9ebf5ea9b1c696136b7af427`	affected	< bbcd723ee7a84bc868142fd57717af88e54e555a
`fa224d0c094a458e9ebf5ea9b1c696136b7af427`	affected	< 4c94557dd02569efa6c1072a0439addaef9a5224
`6.6.67`	affected	< 6.6.158

Linux

affected

Version	Status	Constraints
`6.8`	affected	—
`0`	unaffected	< 6.8
`6.6.158`	unaffected	≤ 6.6.*
`6.12.112`	unaffected	≤ 6.12.*
`6.18.55`	unaffected	≤ 6.18.*
`7.2.9`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[11dc486ed5d4626e6b92a23b67ed76cb6c48bfc9,ff28e6c67143c76ef50c3eac01f2fad411705f71)`	affected	code_commit	—
`[fa224d0c094a458e9ebf5ea9b1c696136b7af427,03a91cdf6862fb351a74f035ad21e70112438552)`	affected	code_commit	—
`[fa224d0c094a458e9ebf5ea9b1c696136b7af427,4e49206d9574a4c109480198e73aea34ad0ed7f6)`	affected	code_commit	—
`[fa224d0c094a458e9ebf5ea9b1c696136b7af427,bbcd723ee7a84bc868142fd57717af88e54e555a)`	affected	code_commit	—
`[fa224d0c094a458e9ebf5ea9b1c696136b7af427,4c94557dd02569efa6c1072a0439addaef9a5224)`	affected	code_commit	—
`[6.6.67,6.6.158)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.8`	affected	generic	—
`[0,6.8)`	unaffected	generic	—
`[6.6.158,7.0.0)`	unaffected	semver	—
`[6.12.112,6.13.0)`	unaffected	semver	—
`[6.18.55,6.19.0)`	unaffected	semver	—
`[7.2.9,7.3.0)`	unaffected	semver	—
`[7.3-rc5,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the Linux kernel update that contains the hci_bind_bis() balance-parent-hold fix.
If an update cannot be applied immediately, limit or disable Bluetooth ISO traffic by configuring the daemon to accept connections only from trusted devices or turning ISO support off.
Enable kernel logging or monitoring for anomalous Bluetooth disconnections to detect and respond to potential exploitation attempts.

Generated by OpenCVE AI on October 22, 2026 at 23:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4850-1	linux-6.12 security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00168.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98459.mbox
https://git.kernel.org/stable/c/03a91cdf6862fb351a74f035ad21e70112438552
https://git.kernel.org/stable/c/4c94557dd02569efa6c1072a0439addaef9a5224
https://git.kernel.org/stable/c/4e49206d9574a4c109480198e73aea34ad0ed7f6
https://git.kernel.org/stable/c/bbcd723ee7a84bc868142fd57717af88e54e555a
https://git.kernel.org/stable/c/ff28e6c67143c76ef50c3eac01f2fad411705f71
https://nvd.nist.gov/vuln/detail/CVE-2026-98459
https://www.cve.org/CVERecord?id=CVE-2026-98459

History

Tue, 20 Oct 2026 13:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-414

Tue, 20 Oct 2026 00:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-911
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98459.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98459 https://www.cve.org/CVERecord?id=CVE-2026-98459
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sun, 18 Oct 2026 17:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-414

Sun, 18 Oct 2026 15:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: balance the parent hold in hci_bind_bis() hci_conn_link() takes a lifetime reference to its parent with hci_conn_get(), but only takes an operational hold on the child. hci_conn_unlink() later balances both a hold and a reference on the parent. The SCO and CIS paths pass a parent acquired from a connect helper, so it already has a hold. For an additional BIS, hci_bind_bis() obtains the parent from hci_conn_hash_lookup_big(), which returns a bare pointer. Unlinking the child then drops the parent's existing hold and can schedule it for disconnection while its socket is still using it. Take a hold on the parent before linking it and drop that hold if linking fails. A successful link transfers the hold to hci_conn_unlink().
Title		Bluetooth: ISO: balance the parent hold in hci_bind_bis()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/03a91cdf6862fb351a74f035ad21e70112438552 https://git.kernel.org/stable/c/4c94557dd02569efa6c1072a0439addaef9a5224 https://git.kernel.org/stable/c/4e49206d9574a4c109480198e73aea34ad0ed7f6 https://git.kernel.org/stable/c/bbcd723ee7a84bc868142fd57717af88e54e555a https://git.kernel.org/stable/c/ff28e6c67143c76ef50c3eac01f2fad411705f71

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-18T15:15:08.537Z

Updated: 2026-10-19T09:19:55.996Z

Reserved: 2026-09-25T10:25:14.350Z

Link: CVE-2026-98459

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-18T16:16:56.327

Modified: 2026-10-19T10:18:55.390

Link: CVE-2026-98459

Redhat

Severity : Moderate

Publid Date: 2026-10-18T00:00:00Z

Links: CVE-2026-98459 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-22T23:30:13Z

Weaknesses

CWE-911
Improper Update of Reference Count

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object