SB2026102228 - Missing Release of Resource after Effective Lifetime in Linux kernel bluetooth

Description

This security bulletin contains information about 1 vulnerability.

1) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98458)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to exhaust connection resources, potentially causing a denial of service.

The vulnerability exists due to missing release of unused connection references in the Linux kernel Bluetooth ISO connection handling code when channel attachment reuses an existing association or fails because another socket is already attached. A local user can repeatedly trigger these channel attachment cases through ISO socket connection attempts to accumulate unreleased connection references and potentially exhaust resources.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/0fcd4dad555c96e0bd3a1b8c569f989be85c7341
• https://git.kernel.org/stable/c/e0e8b70207eaf27aee0a05ec5bf2d1b6bcb004d1
• https://git.kernel.org/stable/c/e5fcca51177f224604e3a8c926ffd5edbeb58b09
• https://git.kernel.org/stable/c/ed4c026cc4094dfb7a329b9d8df0ddd0be1b2458