---
id: CVE-2026-98458
title: 'Bluetooth: ISO: release unused CIS holds after channel attach'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  Bluetooth: ISO: release unused CIS holds after channel attach

  hci_bind_cis() and hci_connect_cis() return one hci_conn hold for the
  ISO layer.  A new channel associati…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 69997d50ec574be816b4ee8f9cee52ebbd53f8bd <
    e0e8b70207eaf27aee0a05ec5bf2d1b6bcb004d1
  - >-
    Linux >= 69997d50ec574be816b4ee8f9cee52ebbd53f8bd <
    ed4c026cc4094dfb7a329b9d8df0ddd0be1b2458
  - >-
    Linux >= 69997d50ec574be816b4ee8f9cee52ebbd53f8bd <
    e5fcca51177f224604e3a8c926ffd5edbeb58b09
  - >-
    Linux >= 69997d50ec574be816b4ee8f9cee52ebbd53f8bd <
    0fcd4dad555c96e0bd3a1b8c569f989be85c7341
  - Linux 6.6
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T15:15:07.572Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98458'
references:
  - url: 'https://git.kernel.org/stable/c/e0e8b70207eaf27aee0a05ec5bf2d1b6bcb004d1'
  - url: 'https://git.kernel.org/stable/c/ed4c026cc4094dfb7a329b9d8df0ddd0be1b2458'
  - url: 'https://git.kernel.org/stable/c/e5fcca51177f224604e3a8c926ffd5edbeb58b09'
  - url: 'https://git.kernel.org/stable/c/0fcd4dad555c96e0bd3a1b8c569f989be85c7341'
tags:
  - cve.org
ingestedAt: '2026-10-18T15:45:12.302Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: release unused CIS holds after channel attach

hci_bind_cis() and hci_connect_cis() return one hci_conn hold for the
ISO layer.  A new channel association consumes that hold, which is
eventually released by iso_conn_free().

There are two cases where iso_chan_add() does not create an association:
it returns success when the socket is already attached to the same
iso_conn, and it returns -EBUSY when another socket is attached.  The
hold returned for the current call is unused in both cases.  This occurs
when deferred setup calls iso_connect_cis() again for its existing
socket, or when another socket attempts to reuse the CIS.

Detect the idempotent case while the connection is locked and release
the unused hold after iso_chan_add().  Also release it on -EBUSY.  Do not
drop it for other errors: a newly allocated iso_conn releases the
transferred hold when its last temporary reference is put.

## Affected

- `Linux >= 69997d50ec574be816b4ee8f9cee52ebbd53f8bd < e0e8b70207eaf27aee0a05ec5bf2d1b6bcb004d1`
- `Linux >= 69997d50ec574be816b4ee8f9cee52ebbd53f8bd < ed4c026cc4094dfb7a329b9d8df0ddd0be1b2458`
- `Linux >= 69997d50ec574be816b4ee8f9cee52ebbd53f8bd < e5fcca51177f224604e3a8c926ffd5edbeb58b09`
- `Linux >= 69997d50ec574be816b4ee8f9cee52ebbd53f8bd < 0fcd4dad555c96e0bd3a1b8c569f989be85c7341`
- `Linux 6.6`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.