CVE-2026-98462

A flaw was found in the Linux kernel's Bluetooth subsystem. Improper reference count management during the reuse and binding of Connected Isochronous Stream (CIS) connections can result in an unbalanced connection hold count. A local attacker could exploit this flaw by triggering specific connection setup and error paths, potentially leading to memory corruption or a denial of service (system crash).

Bluetooth CIS connection reuse violates the documented reference ownership contract because hci_bind_cis can return an existing connection without taking the ISO layer hold. hci_connect_cis can then drop that reference after hci_conn_link returns an existing link without acquiring another CIS hold. This can cause premature object release and creates a potential use-after-free condition in later Bluetooth connection handling. For the CVSS the PR:L is selected because a local user or process must normally access Bluetooth ISO socket functionality, while full administrative privileges are not clearly required. AC:H is selected because triggering depends on CIS reuse, an existing link or bound state, and a suitable object lifetime window. The issue is not proven to be remotely triggerable by a nearby Bluetooth peer without local participation. Impact is at least a local denial of service via kernel crash and in the worst case may allow confidentiality or integrity impact through use-after-free based memory corruption or privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.