CVE-2026-98458

The Linux kernel Bluetooth ISO layer contains a vulnerability where hci_bind_cis() and hci_connect_cis() return an hci_conn hold that may remain unused. Specifically, the hold is not released when iso_chan_add() returns success for an already attached socket (idempotent case) or returns -EBUSY wh...

CVE-2026-98458 Bluetooth: ISO: release unused CIS holds after channel attach

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: release unused CIS holds after channel attach hcibindcis and hciconnectcis return one hciconn hold for the ISO layer. A new channel association consumes that hold, which is eventually released by isoconnfree. Ther...