In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: release unused CIS holds after channel attach hci_bind_cis() and… (CVE-2026-98458)

The Linux kernel Bluetooth ISO layer functions hci_bind_cis() and hci_connect_cis() return a hold on a connection object (hci_conn) for the ISO layer. Normally, this hold is consumed by a new channel association and released by iso_conn_free(). However, in two cases—when iso_chan_add() returns success because the socket is already attached to the same iso_conn, or when it returns -EBUSY because another socket is attached—the hold returned is unused and not released, leading to resource mismanagement. The vulnerability was fixed by detecting the idempotent case while the connection is locked and releasing the unused hold after iso_chan_add(), as well as releasing it on -EBUSY. Holds are not dropped for other errors to ensure proper reference counting.

This vulnerability could lead to improper resource management in the Bluetooth ISO layer of the Linux kernel, potentially causing resource leaks or instability related to connection holds. No direct exploitation or attack scenarios are described in the available data.

A fix has been applied to the Linux kernel to properly release unused connection holds in the Bluetooth ISO layer. Users should update to the patched kernel version once available. No additional mitigation steps are specified.