{"id":40930,"date":"2026-10-19T00:31:36","date_gmt":"2026-10-18T16:31:36","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-98458"},"modified":"2026-10-19T00:31:36","modified_gmt":"2026-10-18T16:31:36","slug":"cve-2026-98458","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-98458","title":{"rendered":"CVE-2026-98458 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: relea"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>Bluetooth: ISO: release unused CIS holds after channel attach<\/p>\n<p>hci_bind_cis() and hci_connect_cis() return one hci_conn hold for the<br \/>\nISO layer.  A new channel association consumes that hold, which is<br \/>\neventually released by iso_conn_free().<\/p>\n<p>There are two cases where iso_chan_add() does not create an association:<br \/>\nit returns success when the socket is already attached to the same<br \/>\niso_conn, and it returns -EBUSY when another socket is attached.  The<br \/>\nhold returned for the current call is unused in both cases.  This occurs<br \/>\nwhen deferred setup calls iso_connect_cis() again for its existing<br \/>\nsocket, or when another socket attempts to reuse the CIS.<\/p>\n<p>Detect the idempotent case while the connection is locked and release<br \/>\nthe unused hold after iso_chan_add().  Also release it on -EBUSY.  Do not<br \/>\ndrop it for other errors: a newly allocated iso_conn releases the<br \/>\ntransferred hold when its last temporary reference is put.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>Bluetooth: ISO: release unused CIS holds after channel attach<\/p>\n<p>hci_bind_cis() and hci_connect_cis() return one hci_conn hold for th<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-40930","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/40930","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=40930"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=40930"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=40930"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}