{"id":40934,"date":"2026-10-19T00:31:36","date_gmt":"2026-10-18T16:31:36","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-98462"},"modified":"2026-10-19T00:31:36","modified_gmt":"2026-10-18T16:31:36","slug":"cve-2026-98462","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-98462","title":{"rendered":"CVE-2026-98462 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_conn:"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>Bluetooth: hci_conn: fix CIS hold ownership on reuse<\/p>\n<p>Commit 69997d50ec57 (&#8220;Bluetooth: ISO: handle bound CIS cleanup via<br \/>\nhci_conn&#8221;) made hci_bind_cis() and hci_connect_cis() return a<br \/>\nconnection with one hold for the ISO layer.  hci_bind_cis() currently<br \/>\ntakes that hold only after configuring a CIS, so its BT_CONNECTED and<br \/>\nmatching BT_BOUND paths return a bare lookup result.  Its configuration<br \/>\nfailure path can likewise call hci_conn_drop() before taking a hold.<\/p>\n<p>Take the hold before any state-dependent return or configuration error<br \/>\nso every successful return follows the documented ownership contract<br \/>\nand every error drop is balanced.<\/p>\n<p>hci_connect_cis() also assumes hci_conn_link() always takes a new CIS<br \/>\nhold before dropping the one returned by hci_bind_cis().  However, the<br \/>\nhelper returns an existing link without taking another hold.  In that<br \/>\ncase, preserve the CIS hold for the caller and drop the redundant LE<br \/>\nhold because the existing link already owns its parent hold.  Returning<br \/>\nearly also avoids changing an existing CIS back to BT_CONNECT.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>Bluetooth: hci_conn: fix CIS hold ownership on reuse<\/p>\n<p>Commit 69997d50ec57 (&#8220;Bluetooth: ISO: handle bound CIS cleanup via<br \/>\nhci_conn&#8221;)<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-40934","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/40934","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=40934"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=40934"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=40934"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}