UBUNTU-CVE-2026-98458: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: release unused CIS holds after channel attach hcibindcis() and hciconnectcis() return one hciconn hold for the ISO layer. A new channel association consumes that hold, which is eventually released by isoconnfree(). There are two cases where isochanadd() does not create an association: it returns success when the socket is already attached to the same isoconn, and it returns -EBUSY when another socket is attached. The hold returned for the current call is unused in both cases. This occurs when deferred setup calls isoconnectcis() again for its existing socket, or when another socket attempts to reuse the CIS. Detect the idempotent case while the connection is locked and release the unused hold after isochanadd(). Also release it on -EBUSY. Do not drop it for other errors: a newly allocated isoconn releases the transferred hold when its last temporary reference is put.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
What access does an attacker need to trigger this issue?
The vector is local and requires low privileges. No user interaction is required.
Which systems are exposed?
Systems using the affected Ubuntu Linux kernel packages listed here are in scope. The issue is in the Bluetooth ISO/CIS connection handling path, so exposure depends on use of that functionality.
What is the impact of successful exploitation?
The provided severity vector indicates an availability impact limited to the vulnerable component, with no stated confidentiality or integrity impact. The flaw involves unreleased connection references when an existing ISO connection is reattached or another socket attempts to reuse a CIS.
How can administrators tell whether the vulnerable condition has occurred?
The data does not provide a detection method or observable indicator. The relevant triggering cases are deferred setup reconnecting an existing socket and another socket attempting to reuse the same CIS.