CVE-2026-98458: Linux Kernel Bluetooth ISO Privilege Escalation

CVE-2026-98458 Overview

CVE-2026-98458 is a reference-counting flaw in the Linux kernel's Bluetooth Isochronous Channels (ISO) subsystem. The functions hci_bind_cis() and hci_connect_cis() each return an hci_conn reference hold intended for the ISO layer. When iso_chan_add() does not create a new channel association, the hold returned by the current call goes unused and is never released. This condition triggers during deferred setup when iso_connect_cis() runs again on an existing socket, or when another socket attempts to reuse the Connected Isochronous Stream (CIS).

Critical Impact
Repeated triggering of the idempotent or -EBUSY code paths leaks hci_conn references, which can prevent proper connection teardown and lead to resource exhaustion in the Bluetooth stack.

Affected Products

Linux kernel Bluetooth subsystem (ISO layer)
Stable kernel branches referenced by commits 0fcd4da, e0e8b70, e5fcca5, and ed4c026
Systems using Bluetooth LE Audio features that rely on Connected Isochronous Streams

Discovery Timeline

2026-10-18 - CVE-2026-98458 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-98458

Vulnerability Analysis

The vulnerability resides in the Linux kernel Bluetooth ISO socket layer, which manages isochronous data channels used for LE Audio. The functions hci_bind_cis() and hci_connect_cis() each hand back one hci_conn reference hold that the ISO layer is expected to consume through a new channel association. Normally, iso_conn_free() releases this hold when the associated connection is torn down.

Two code paths break this contract. First, iso_chan_add() returns success when the socket is already attached to the same iso_conn, but no new association consumes the hold. Second, iso_chan_add() returns -EBUSY when another socket is already attached to the target connection, again leaving the hold orphaned. Both scenarios cause an imbalance in the hci_conn reference count.

Root Cause

The root cause is a missing release of a transferred reference count on paths where iso_chan_add() does not establish a new channel association. The ISO layer unconditionally expects the association call to absorb the hold, but the idempotent-attach and busy-conflict cases do not.

Attack Vector

A local process with permission to open Bluetooth ISO sockets can trigger the leaky paths by repeatedly invoking deferred setup against an existing socket, or by racing multiple sockets to attach to the same CIS. Each triggering call leaks an hci_conn reference. Over time, this prevents connections from being freed and can degrade Bluetooth stack availability.

No verified public exploit code is available. See the upstream fix commits for the precise code changes.

Detection Methods for CVE-2026-98458

Indicators of Compromise

Unexpected growth in the number of lingering hci_conn objects visible through /sys/kernel/debug/bluetooth/ interfaces
Bluetooth ISO connections that remain allocated after sockets are closed
Kernel log entries referencing repeated iso_connect_cis() calls or -EBUSY returns from ISO channel attach operations

Detection Strategies

Monitor the installed Linux kernel version against the fixed commits (0fcd4da, e0e8b70, e5fcca5, ed4c026) using configuration management tooling
Audit systems that expose Bluetooth LE Audio functionality, especially endpoints handling untrusted local user sessions
Track Bluetooth subsystem resource usage trends and alert on sustained increases in active connection counts

Monitoring Recommendations

Collect kernel logs and Bluetooth subsystem telemetry for anomalies in CIS attach and detach operations
Baseline normal hci_conn lifetime and alert on connections persisting beyond expected session durations
Correlate Bluetooth stack events with process activity to identify local processes abusing ISO socket APIs

How to Mitigate CVE-2026-98458

Immediate Actions Required

Apply the upstream kernel patches referenced by commits 0fcd4da, e0e8b70, e5fcca5, and ed4c026 from distribution security channels
Prioritize patching on systems that expose Bluetooth LE Audio to untrusted local users or multi-user environments
Inventory kernels in the environment and schedule a reboot after installing updated packages

Patch Information

The fix detects the idempotent attach case while the connection is locked and releases the unused hci_conn hold after iso_chan_add(). The hold is also released on -EBUSY. For other errors, the hold is retained because a newly allocated iso_conn releases the transferred hold when its last temporary reference is put. See the upstream references: Kernel Git Commit 0fcd4da, Kernel Git Commit e0e8b70, Kernel Git Commit e5fcca5, and Kernel Git Commit ed4c026.

Workarounds

Disable the Bluetooth subsystem on systems where it is not required by unloading or blacklisting the relevant kernel modules
Restrict access to Bluetooth ISO socket interfaces by limiting which users can open AF_BLUETOOTH sockets
Disable LE Audio features in Bluetooth configuration where CIS functionality is not needed

bash

# Example: blacklist Bluetooth modules where the stack is not needed
echo 'blacklist bluetooth' | sudo tee /etc/modprobe.d/disable-bluetooth.conf
echo 'blacklist btusb' | sudo tee -a /etc/modprobe.d/disable-bluetooth.conf
sudo update-initramfs -u