All vulnerabilities
CVE-2026-98295

Linux: Bluetooth: coredump: Quiesce dump work on unregister

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.18%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in24af375d7d8aa5f698e4dc41317102f44114351aAlso 82699d1b727ba5980b94f1eb8dc3d346f41b7c67, 6.2CVE List
Published6 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 24af375d7d8aa5f698e4dc41317102f44114351aLinuxCVE List
  • 82699d1b727ba5980b94f1eb8dc3d346f41b7c67LinuxCVE List
  • 6.2LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: coredump: Quiesce dump work on unregister

hci_devcd_handle_pkt_init() arms dump_timeout and coredump producers queue dump_rx without holding an hdev reference. Unregister leaves both works live, so disconnecting during an active dump lets them access hdev after hci_release_dev() frees it.

Shut down coredump processing during unregister. Close the producer gate under dump_q.lock before disabling both works, then free the active buffer and queued packets under hci_dev_lock. Serializing the gate with enqueue prevents controller-specific workers from adding packets after the final purge.

Text from CVE List

Affected versions 12

  • Linuxaffected: 9695ef876fd122cb7bbc04a4a93b8727d2e36bda before 24af375d7d8aa5f698e4dc41317102f44114351aCVE List
  • Linuxaffected: 9695ef876fd122cb7bbc04a4a93b8727d2e36bda before dcaf10ef27f928568c25de3e9fc242e538de5c67CVE List
  • Linuxaffected: 9695ef876fd122cb7bbc04a4a93b8727d2e36bda before 82699d1b727ba5980b94f1eb8dc3d346f41b7c67CVE List
  • Linuxaffected: 9695ef876fd122cb7bbc04a4a93b8727d2e36bda before d236517c264e41dc09833c708ef23bccb7a91219CVE List
  • Linuxaffected: deb8156ebe5cb63a5988e7f86cc46aa062527c2bCVE List
  • Linuxaffected: 6.1.188 before 6.2CVE List
  • Linuxaffected: 6.4CVE List
  • Linuxunaffected: all versions before 6.4CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.54 through 6.18.*CVE List
  • Linuxunaffected: 7.2.8 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 4