CVE-2026-98459

A flaw was found in the Linux kernel's Bluetooth subsystem. This flaw allows a local user to cause a Denial of Service (DoS) due to improper reference counting when handling Broadcast Isochronous Stream (BIS) connections. During unlinking operations, the kernel may prematurely release an active parent connection while its socket is still in use, leading to a kernel crash.

This vulnerability is rated as having Moderate impact because exploitation is restricted to local authenticated users and can result in a denial of service without compromising data confidentiality or system integrity. In typical Red Hat Enterprise Linux server environments, Bluetooth hardware and services are absent or not configured, substantially reducing exposure. The risk is limited to installations where active Bluetooth interfaces are accessible to unprivileged local accounts.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.