In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: fix CIS hold ownership on reuse Commit 69997d50ec57… (CVE-2026-98462)

The vulnerability in the Linux kernel Bluetooth subsystem was due to incorrect handling of CIS hold ownership on reuse. Specifically, the functions hci_bind_cis() and hci_connect_cis() did not consistently manage connection holds, sometimes returning connections without the expected ownership hold or dropping holds prematurely. This could cause state inconsistencies in the Bluetooth ISO layer. The fix ensures that holds are taken before any state-dependent return or error, maintaining the documented ownership contract and balancing hold drops correctly. Additionally, hci_connect_cis() was corrected to preserve CIS holds properly when reusing existing links, avoiding redundant holds and state regressions.

The impact involves potential inconsistencies in Bluetooth ISO layer connection state management within the Linux kernel. While the exact exploitation impact is not detailed, improper hold management could lead to unstable Bluetooth connections or resource mismanagement. There is no indication of active exploitation in the wild or direct security compromise such as privilege escalation or remote code execution.

A fix has been implemented in the Linux kernel to correct CIS hold ownership handling. Users and administrators should update to the fixed kernel version once available. Since this is a kernel-level Bluetooth subsystem fix, applying the official kernel update from the Linux distribution vendor is the recommended remediation.