{"id":"CVE-2026-98459","revision":"10c9334d954c472d99b741274b61cab9","records":[{"revision":"10c9334d954c472d99b741274b61cab9","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-98459","aliases":[],"title":"Bluetooth: ISO: balance the parent hold in hci_bind_bis()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: balance the parent hold in hci_bind_bis()\n\nhci_conn_link() takes a lifetime reference to its parent with\nhci_conn_get(), but only takes an operational hold on the child.\nhci_conn_unlink() later balances both a hold and a reference on the\nparent.\n\nThe SCO and CIS paths pass a parent acquired from a connect helper, so\nit already has a hold. For an additional BIS, hci_bind_bis() obtains the\nparent from hci_conn_hash_lookup_big(), which returns a bare pointer.\nUnlinking the child then drops the parent's existing hold and can\nschedule it for disconnection while its socket is still using it.\n\nTake a hold on the parent before linking it and drop that hold if linking\nfails. A successful link transfers the hold to hci_conn_unlink().","state":0,"publishedAt":"2026-10-18T15:15:08.537+00:00","modifiedAt":"2026-10-19T09:19:55.996+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/bluetooth/hci_conn.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"11dc486ed5d4626e6b92a23b67ed76cb6c48bfc9\",\n                            \"lessThan\": \"ff28e6c67143c76ef50c3eac01f2fad411705f71\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"fa224d0c094a458e9ebf5ea9b1c696136b7af427\",\n                            \"lessThan\": \"03a91cdf6862fb351a74f035ad21e70112438552\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"fa224d0c094a458e9ebf5ea9b1c696136b7af427\",\n                            \"lessThan\": \"4e49206d9574a4c109480198e73aea34ad0ed7f6\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"fa224d0c094a458e9ebf5ea9b1c696136b7af427\",\n                            \"lessThan\": \"bbcd723ee7a84bc868142fd57717af88e54e555a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"fa224d0c094a458e9ebf5ea9b1c696136b7af427\",\n                            \"lessThan\": \"4c94557dd02569efa6c1072a0439addaef9a5224\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"6.6.67\",\n                            \"lessThan\": \"6.6.158\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/bluetooth/hci_conn.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.8\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.8\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.158\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.112\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.55\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.9\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/ff28e6c67143c76ef50c3eac01f2fad411705f71","https://git.kernel.org/stable/c/03a91cdf6862fb351a74f035ad21e70112438552","https://git.kernel.org/stable/c/4e49206d9574a4c109480198e73aea34ad0ed7f6","https://git.kernel.org/stable/c/bbcd723ee7a84bc868142fd57717af88e54e555a","https://git.kernel.org/stable/c/4c94557dd02569efa6c1072a0439addaef9a5224"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98459","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-98459","identifiers":["CVE-2026-98459"]},"retained":false,"historicalAffected":[]}],"coverage":[]}