CVE-2026-98459: Bluetooth: ISO: balance the parent hold in hci_bind_bis()
Bluetooth: ISO: balance the parent hold in hcibindbis()
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.159.1-1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.158 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.112 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.55 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.9 - Compensating control
In hci_bind_bis(), take a hold on the parent returned by hci_conn_hash_lookup_big() before linking it, and drop that hold if linking fails, so hci_conn_unlink() can safely balance the parent hold and reference.
Event History
Frequently Asked Questions
Which Bluetooth connection path is affected?
The issue affects the BIS path when an additional BIS is bound and its parent connection is obtained through hci_conn_hash_lookup_big(). The SCO and CIS paths are described as already receiving a parent connection with an operational hold.
What can happen if the affected path is triggered?
When the BIS child is unlinked, it can drop the parent connection's existing hold. This can schedule the parent for disconnection while its socket is still using it.
What is the available remediation?
The resolved change takes an operational hold on the parent before linking the BIS child, drops that hold if linking fails, and transfers it to hci_conn_unlink() after a successful link. The provided stable kernel references identify commits containing the fix.