CVE-2026-98458

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98458", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.350Z", "datePublished": "2026-10-18T15:15:07.572Z", "dateUpdated": "2026-10-19T09:19:54.818Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:19:54.818Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: release unused CIS holds after channel attach\n\nhci_bind_cis() and hci_connect_cis() return one hci_conn hold for the\nISO layer. A new channel association consumes that hold, which is\neventually released by iso_conn_free().\n\nThere are two cases where iso_chan_add() does not create an association:\nit returns success when the socket is already attached to the same\niso_conn, and it returns -EBUSY when another socket is attached. The\nhold returned for the current call is unused in both cases. This occurs\nwhen deferred setup calls iso_connect_cis() again for its existing\nsocket, or when another socket attempts to reuse the CIS.\n\nDetect the idempotent case while the connection is locked and release\nthe unused hold after iso_chan_add(). Also release it on -EBUSY. Do not\ndrop it for other errors: a newly allocated iso_conn releases the\ntransferred hold when its last temporary reference is put."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bluetooth/iso.c"], "versions": [{"version": "69997d50ec574be816b4ee8f9cee52ebbd53f8bd", "lessThan": "e0e8b70207eaf27aee0a05ec5bf2d1b6bcb004d1", "status": "affected", "versionType": "git"}, {"version": "69997d50ec574be816b4ee8f9cee52ebbd53f8bd", "lessThan": "ed4c026cc4094dfb7a329b9d8df0ddd0be1b2458", "status": "affected", "versionType": "git"}, {"version": "69997d50ec574be816b4ee8f9cee52ebbd53f8bd", "lessThan": "e5fcca51177f224604e3a8c926ffd5edbeb58b09", "status": "affected", "versionType": "git"}, {"version": "69997d50ec574be816b4ee8f9cee52ebbd53f8bd", "lessThan": "0fcd4dad555c96e0bd3a1b8c569f989be85c7341", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bluetooth/iso.c"], "versions": [{"version": "6.6", "status": "affected"}, {"version": "0", "lessThan": "6.6", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.113", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.55", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.9", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.12.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.18.55"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "7.2.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/e0e8b70207eaf27aee0a05ec5bf2d1b6bcb004d1"}, {"url": "https://git.kernel.org/stable/c/ed4c026cc4094dfb7a329b9d8df0ddd0be1b2458"}, {"url": "https://git.kernel.org/stable/c/e5fcca51177f224604e3a8c926ffd5edbeb58b09"}, {"url": "https://git.kernel.org/stable/c/0fcd4dad555c96e0bd3a1b8c569f989be85c7341"}], "title": "Bluetooth: ISO: release unused CIS holds after channel attach", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/bluetooth/iso.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "e0e8b70207eaf27aee0a05ec5bf2d1b6bcb004d1", "status": "affected", "version": "69997d50ec574be816b4ee8f9cee52ebbd53f8bd", "versionType": "git"}, {"lessThan": "ed4c026cc4094dfb7a329b9d8df0ddd0be1b2458", "status": "affected", "version": "69997d50ec574be816b4ee8f9cee52ebbd53f8bd", "versionType": "git"}, {"lessThan": "e5fcca51177f224604e3a8c926ffd5edbeb58b09", "status": "affected", "version": "69997d50ec574be816b4ee8f9cee52ebbd53f8bd", "versionType": "git"}, {"lessThan": "0fcd4dad555c96e0bd3a1b8c569f989be85c7341", "status": "affected", "version": "69997d50ec574be816b4ee8f9cee52ebbd53f8bd", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/bluetooth/iso.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.6"}, {"lessThan": "6.6", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.113", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.55", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: release unused CIS holds after channel attach\n\nhci_bind_cis() and hci_connect_cis() return one hci_conn hold for the\nISO layer. A new channel association consumes that hold, which is\neventually released by iso_conn_free().\n\nThere are two cases where iso_chan_add() does not create an association:\nit returns success when the socket is already attached to the same\niso_conn, and it returns -EBUSY when another socket is attached. The\nhold returned for the current call is unused in both cases. This occurs\nwhen deferred setup calls iso_connect_cis() again for its existing\nsocket, or when another socket attempts to reuse the CIS.\n\nDetect the idempotent case while the connection is locked and release\nthe unused hold after iso_chan_add(). Also release it on -EBUSY. Do not\ndrop it for other errors: a newly allocated iso_conn releases the\ntransferred hold when its last temporary reference is put."}], "id": "CVE-2026-98458", "lastModified": "2026-10-19T10:18:55.257", "metrics": {}, "published": "2026-10-18T16:16:56.230", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0fcd4dad555c96e0bd3a1b8c569f989be85c7341"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e0e8b70207eaf27aee0a05ec5bf2d1b6bcb004d1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e5fcca51177f224604e3a8c926ffd5edbeb58b09"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ed4c026cc4094dfb7a329b9d8df0ddd0be1b2458"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Bluetooth: ISO: release unused CIS holds after channel attach", "id": "2554868", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2554868"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-911", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nBluetooth: ISO: release unused CIS holds after channel attach\nhci_bind_cis() and hci_connect_cis() return one hci_conn hold for the\nISO layer. A new channel association consumes that hold, which is\neventually released by iso_conn_free().\nThere are two cases where iso_chan_add() does not create an association:\nit returns success when the socket is already attached to the same\niso_conn, and it returns -EBUSY when another socket is attached. The\nhold returned for the current call is unused in both cases. This occurs\nwhen deferred setup calls iso_connect_cis() again for its existing\nsocket, or when another socket attempts to reuse the CIS.\nDetect the idempotent case while the connection is locked and release\nthe unused hold after iso_chan_add(). Also release it on -EBUSY. Do not\ndrop it for other errors: a newly allocated iso_conn releases the\ntransferred hold when its last temporary reference is put.", "A flaw was found in the Linux kernel's Bluetooth subsystem. A local attacker can cause a Denial of Service (DoS) through a reference count leak during Bluetooth Isochronous (ISO) channel attachment. When a socket attempts to attach to a channel that is already connected or in use by another socket, the kernel fails to release acquired connection holds. Repeated connection attempts under these conditions can prevent connection resources from being freed, resulting in system resource exhaustion."], "name": "CVE-2026-98458", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98458\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98458\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98458.mbox"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[69997d50ec574be816b4ee8f9cee52ebbd53f8bd,0e0e8b70207eaf27aee0a05ec5bf2d1b6bcb004d1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[69997d50ec574be816b4ee8f9cee52ebbd53f8bd,ed4c026cc4094dfb7a329b9d8df0ddd0be1b2458)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[69997d50ec574be816b4ee8f9cee52ebbd53f8bd,e5fcca51177f224604e3a8c926ffd5edbeb58b09)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[69997d50ec574be816b4ee8f9cee52ebbd53f8bd,0fcd4dad555c96e0bd3a1b8c569f989be85c7341)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.6"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.6)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.113,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.55,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.9,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T17:00:09.234875+00:00", "updated": "2026-10-20T20:45:14.331973+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}