CVE-2026-98462
Description
A flaw was found in the Linux kernel's Bluetooth subsystem. Improper reference count management during the reuse and binding of Connected Isochronous Stream (CIS) connections can result in an unbalanced connection hold count. A local attacker could exploit this flaw by triggering specific connection setup and error paths, potentially leading to memory corruption or a denial of service (system crash).
Statement
Bluetooth CIS connection reuse violates the documented reference ownership contract because hci_bind_cis can return an existing connection without taking the ISO layer hold. hci_connect_cis can then drop that reference after hci_conn_link returns an existing link without acquiring another CIS hold. This can cause premature object release and creates a potential use-after-free condition in later Bluetooth connection handling. For the CVSS the PR:L is selected because a local user or process must normally access Bluetooth ISO socket functionality, while full administrative privileges are not clearly required. AC:H is selected because triggering depends on CIS reuse, an existing link or bound state, and a suitable object lifetime window. The issue is not proven to be remotely triggerable by a nearby Bluetooth peer without local participation. Impact is at least a local denial of service via kernel crash and in the worst case may allow confidentiality or integrity impact through use-after-free based memory corruption or privilege escalation.
Mitigation
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.7 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | High | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
