CVE-2026-98459: Linux Kernel Bluetooth ISO Privilege Escalation

CVE-2026-98459 Overview

CVE-2026-98459 is a Linux kernel vulnerability in the Bluetooth Isochronous (ISO) subsystem. The flaw resides in hci_bind_bis(), where a reference counting imbalance on the parent Broadcast Isochronous Group (BIG) connection can cause premature teardown. When an additional Broadcast Isochronous Stream (BIS) is bound, hci_conn_hash_lookup_big() returns a bare pointer without taking a hold. Later, hci_conn_unlink() drops a hold that was never acquired, scheduling the parent for disconnection while sockets still reference it. The condition affects the Linux kernel Bluetooth stack and has been resolved upstream through five stable backport commits.

Critical Impact
Local processes using Bluetooth LE Audio broadcast streams can trigger a use-after-free style condition on the parent BIG connection, leading to kernel instability or potential memory corruption.

Affected Products

Linux kernel Bluetooth subsystem (ISO/BIS code path)
Distributions shipping affected kernels prior to the referenced stable patches
Systems with Bluetooth LE Audio broadcast functionality enabled

Discovery Timeline

2026-10-18 - CVE-2026-98459 published to the National Vulnerability Database
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-98459

Vulnerability Analysis

The Linux kernel Bluetooth stack manages connections through reference counts tracked by hci_conn_get() and hci_conn_put(). In the ISO path, hci_conn_link() acquires a lifetime reference on the parent connection and an operational hold on the child. The symmetric routine hci_conn_unlink() later releases both a hold and a reference on the parent.

For Synchronous Connection-Oriented (SCO) and Connected Isochronous Stream (CIS) flows, the parent connection arrives from a connect helper that already holds the required reference. The Broadcast Isochronous Stream (BIS) path diverges from this pattern. hci_bind_bis() resolves the parent via hci_conn_hash_lookup_big(), which returns a raw pointer without incrementing the reference count.

Root Cause

The imbalance occurs because hci_conn_unlink() assumes a hold exists on the parent. When the parent originated from hci_conn_hash_lookup_big(), no such hold was taken. Unlinking the child therefore releases a reference that was never acquired, decrementing the parent's refcount below the expected floor. The parent connection can then be scheduled for disconnection while an active ISO socket still references it, producing a use-after-free style condition in kernel memory.

Attack Vector

Triggering the condition requires local access and the ability to open Bluetooth ISO sockets associated with a BIG. An attacker able to create and tear down broadcast streams can drive the parent's reference count into an inconsistent state. The patch resolves the issue by taking a hold on the parent before linking and dropping it if linking fails, so a successful link transfers ownership to hci_conn_unlink(). Refer to the upstream fix in Kernel Commit 4e49206 and backports in Kernel Commit 03a91cd, Kernel Commit 4c94557, Kernel Commit bbcd723, and Kernel Commit ff28e6c.

Detection Methods for CVE-2026-98459

Indicators of Compromise

Unexpected BUG: or KASAN reports in dmesg referencing hci_conn, hci_bind_bis, or hci_conn_unlink.
Kernel oops or panic traces originating from the net/bluetooth/iso.c or net/bluetooth/hci_conn.c source paths.
Repeated creation and teardown of Bluetooth ISO/BIS sockets by unprivileged processes in audit logs.

Detection Strategies

Inventory running kernel versions across Linux endpoints and compare against the fixed stable releases referenced in the upstream commits.
Enable KASAN on test systems that exercise Bluetooth LE Audio features to catch reference-count imbalances during QA.
Monitor process activity for workloads invoking socket(AF_BLUETOOTH, SOCK_SEQPACKET, BTPROTO_ISO) from non-privileged contexts.

Monitoring Recommendations

Forward kernel ring buffer and journald events to a centralized logging pipeline for crash and warning correlation.
Alert on repeated Bluetooth subsystem crashes or module reloads on identical hosts within short windows.
Track /proc/kallsyms-anchored stack traces that reference the Bluetooth connection management functions.

How to Mitigate CVE-2026-98459

Immediate Actions Required

Apply the vendor kernel update that incorporates the upstream fix to all affected Linux systems.
On systems that do not require Bluetooth, blacklist the bluetooth and btusb kernel modules to eliminate the attack surface.
Restrict access to Bluetooth ISO sockets by limiting local account privileges on multi-user hosts.

Patch Information

The fix is available in the mainline Linux kernel and has been backported to stable trees. Reference the upstream commit at Kernel Commit 4e49206 and the stable backports at Kernel Commit 03a91cd, Kernel Commit 4c94557, Kernel Commit bbcd723, and Kernel Commit ff28e6c. Install distribution-provided kernel packages that include these commits and reboot affected hosts.

Workarounds

Disable Bluetooth entirely on servers and workstations that do not require LE Audio broadcast functionality.
Unload the Bluetooth kernel modules using modprobe -r and prevent reload via /etc/modprobe.d/ entries where disabling is acceptable.
Where Bluetooth is required, avoid exposing BIS/BIG features to untrusted local workloads until patched kernels are deployed.

bash

# Configuration example: block Bluetooth stack loading until patched kernel is installed
echo 'install bluetooth /bin/true' | sudo tee /etc/modprobe.d/disable-bluetooth.conf
echo 'install btusb /bin/true'    | sudo tee -a /etc/modprobe.d/disable-bluetooth.conf
sudo modprobe -r btusb bluetooth 2>/dev/null || true
sudo systemctl disable --now bluetooth.service