In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: balance the parent hold in hci_bind_bis() hci_conn_link() takes… (CVE-2026-98459)

The vulnerability in the Linux kernel Bluetooth ISO subsystem concerns the handling of parent connection references in the hci_bind_bis() function. Specifically, hci_conn_link() takes a lifetime reference to its parent connection, but only an operational hold on the child. The unlinking process drops both the hold and reference on the parent. For additional BIS connections, hci_bind_bis() obtains the parent from hci_conn_hash_lookup_big(), which returns a bare pointer without a hold. This can cause the parent's existing hold to be dropped prematurely during unlinking, potentially scheduling the parent for disconnection while its socket is still active. The resolution involves taking a hold on the parent before linking and dropping that hold if linking fails, ensuring proper reference counting and connection stability.

If unpatched, this flaw could cause the parent Bluetooth connection to be disconnected prematurely while still in use by its socket, potentially leading to unexpected disconnections or resource management issues in Bluetooth ISO connections. There is no indication of active exploitation in the wild.

A fix has been implemented in the Linux kernel to properly balance the parent connection holds in hci_bind_bis(). Users should apply the official Linux kernel updates that include this fix. Since this is a kernel-level issue, updating to a patched kernel version is the recommended remediation.