Missing Release of Resource after Effective Lifetime in Linux kernel - CVE-2026-98458

Vulnerability identifier: #VU156756

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-98458

CWE-ID: CWE-772

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to exhaust connection resources, potentially causing a denial of service.

The vulnerability exists due to missing release of unused connection references in the Linux kernel Bluetooth ISO connection handling code when channel attachment reuses an existing association or fails because another socket is already attached. A local user can repeatedly trigger these channel attachment cases through ISO socket connection attempts to accumulate unreleased connection references and potentially exhaust resources.

Linux kernel
Ubuntu
linux (Ubuntu package)
linux-aws (Ubuntu package)
linux-gcp (Ubuntu package)
linux-oracle (Ubuntu package)
linux-ibm (Ubuntu package)
linux-hwe-7.0 (Ubuntu package)
linux-oem-7.0 (Ubuntu package)

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux (Ubuntu package) - update to 7.0.0-42.42
linux-aws (Ubuntu package) - update to 7.0.0-1016.17
linux-gcp (Ubuntu package) - update to 7.0.0-1016.18
linux-oracle (Ubuntu package) - update to 7.0.0-1015.16
linux-ibm (Ubuntu package) - update to 7.0.0-1017.17
linux-hwe-7.0 (Ubuntu package) - update to 7.0.0-42.42~24.04.1
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1017.17

• https://git.kernel.org/stable/c/0fcd4dad555c96e0bd3a1b8c569f989be85c7341
• https://git.kernel.org/stable/c/e0e8b70207eaf27aee0a05ec5bf2d1b6bcb004d1
• https://git.kernel.org/stable/c/e5fcca51177f224604e3a8c926ffd5edbeb58b09
• https://git.kernel.org/stable/c/ed4c026cc4094dfb7a329b9d8df0ddd0be1b2458

• Missing Release of Resource after Effective Lifetime in Linux kernel bluetooth
• Ubuntu update for linux-oem-7.0
• Ubuntu update for linux, linux-aws, linux-gcp and more