What’s Vulnerable › Vulnerabilities

CVE-2026-98293: Bluetooth: ISO: Fix parent socket leak in iso_conn_ready()

• Severity: unknown
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-06 · updated 2026-10-19

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix parent socket leak in iso_conn_ready() iso_get_sock() returns the parent socket with a reference held, which is dropped by sock_put() once the child socket has been set up. The error path taken when iso_sock_alloc() fails only calls release_sock() and returns, leaking the reference and thus the parent socket itself. Drop the reference on that path as well.

Affected products

• Linux kernel: from 6.6.67 before 6.6.158; 6.8 — fixed in 6.6.158, 7.3

How to fix

Upgrade to a fixed version: Linux kernel 6.6.158, 7.3. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/9228f87365e68a6cae191f57f456e89a6d2167cf
• https://git.kernel.org/stable/c/ca18ee413a7cb6f09885778039225e58bae0d607
• https://git.kernel.org/stable/c/e2b156a8d25966be49c1f809b654a2c4bb16564d
• https://git.kernel.org/stable/c/ea8a262662be62c095789924c11722ecbf40a4de
• https://git.kernel.org/stable/c/f016daabd4fec4e9b8563f8b6f42eabce0ca66b0

Get alerted when CVE-2026-98293 or the next vulnerability affects your stack