CVE-2026-98295 - Vulnerability Details

- Bluetooth: coredump: Quiesce dump work on unregister

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: coredump: Quiesce dump work on unregister

hci_devcd_handle_pkt_init() arms dump_timeout and coredump producers
queue dump_rx without holding an hdev reference. Unregister leaves both
works live, so disconnecting during an active dump lets them access hdev
after hci_release_dev() frees it.

Shut down coredump processing during unregister. Close the producer gate
under dump_q.lock before disabling both works, then free the active buffer
and queued packets under hci_dev_lock. Serializing the gate with enqueue
prevents controller-specific workers from adding packets after the final
purge.

Published: 2026-10-06

Score: 7.0 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

In the Linux kernel Bluetooth subsystem, a flaw in the coredump handling allows a device to be unregistered while a dump operation is still active. The unregister process fails to stop dump work threads, which continue to access the freed hdev structure. This results in a use‑after‑free that can corrupt kernel memory, potentially leading to system crashes.

Affected Systems

All Linux kernel implementations that expose the Bluetooth subsystem and do not include the patch are affected. The vulnerability is identified by the generic Linux kernel CPE; no specific vendor or version numbers are supplied beyond the kernel itself. Any distribution running a kernel version older than the commit that disables coredump processing on unregister could be compromised.

Risk and Exploitability

The vulnerability allows an attacker to cause a use‑after‑free by disconnecting a Bluetooth device while a dump is in progress. The CVSS score is 7.0, indicating medium severity. This can corrupt kernel memory and potentially lead to system crashes. The EPSS score indicates a very low but non‑zero exploitation probability (<1%). The vulnerability is not listed in CISA’s KEV catalog. Even without a published exploit, the defect poses significant risk to confidentiality, integrity, and availability of affected systems.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`9695ef876fd122cb7bbc04a4a93b8727d2e36bda`	affected	< 24af375d7d8aa5f698e4dc41317102f44114351a
`9695ef876fd122cb7bbc04a4a93b8727d2e36bda`	affected	< dcaf10ef27f928568c25de3e9fc242e538de5c67
`9695ef876fd122cb7bbc04a4a93b8727d2e36bda`	affected	< 82699d1b727ba5980b94f1eb8dc3d346f41b7c67
`9695ef876fd122cb7bbc04a4a93b8727d2e36bda`	affected	< d236517c264e41dc09833c708ef23bccb7a91219
`deb8156ebe5cb63a5988e7f86cc46aa062527c2b`	affected	—
`6.1.188`	affected	< 6.2

Linux

affected

Version	Status	Constraints
`6.4`	affected	—
`0`	unaffected	< 6.4
`6.12.112`	unaffected	≤ 6.12.*
`6.18.54`	unaffected	≤ 6.18.*
`7.2.8`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[9695ef876fd122cb7bbc04a4a93b8727d2e36bda,24af375d7d8aa5f698e4dc41317102f44114351a)`	affected	code_commit	—
`[9695ef876fd122cb7bbc04a4a93b8727d2e36bda,dcaf10ef27f928568c25de3e9fc242e538de5c67)`	affected	code_commit	—
`[9695ef876fd122cb7bbc04a4a93b8727d2e36bda,82699d1b727ba5980b94f1eb8dc3d346f41b7c67)`	affected	code_commit	—
`[9695ef876fd122cb7bbc04a4a93b8727d2e36bda,d236517c264e41dc09833c708ef23bccb7a91219)`	affected	code_commit	—
`deb8156ebe5cb63a5988e7f86cc46aa062527c2b`	affected	code_commit	—
`[6.1.188,6.2)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.4`	affected	semver	—
`[0,6.4)`	unaffected	semver	—
`[6.12.112,6.13.0)`	unaffected	semver	—
`[6.18.54,6.19.0)`	unaffected	semver	—
`[7.2.8,7.3.0)`	unaffected	semver	—
`[7.3-rc4,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes the patch for the use‑after‑free flaw (CWE‑825) which stops coredump work during device unregistration and purges queued packets.
After applying the kernel update, restart the Bluetooth service or reboot the host to unload remaining workers and load the fixed code.
If an upgrade cannot be applied immediately, disable or restrict Bluetooth services so that device disconnects cannot occur while a dump may be in progress, monitor the system for kernel panics or irregular crashes, and apply the patch as soon as possible.

Generated by OpenCVE AI on October 11, 2026 at 18:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4850-1	linux-6.12 security update
Debian DSA	DSA-6568-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00168.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98295.mbox
https://git.kernel.org/stable/c/24af375d7d8aa5f698e4dc41317102f44114351a
https://git.kernel.org/stable/c/82699d1b727ba5980b94f1eb8dc3d346f41b7c67
https://git.kernel.org/stable/c/d236517c264e41dc09833c708ef23bccb7a91219
https://git.kernel.org/stable/c/dcaf10ef27f928568c25de3e9fc242e538de5c67
https://nvd.nist.gov/vuln/detail/CVE-2026-98295
https://www.cve.org/CVERecord?id=CVE-2026-98295

History

Sun, 11 Oct 2026 16:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-362 CWE-416

Sun, 11 Oct 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98295.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98295 https://www.cve.org/CVERecord?id=CVE-2026-98295
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Wed, 07 Oct 2026 04:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-362 CWE-416

Tue, 06 Oct 2026 18:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Tue, 06 Oct 2026 14:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Tue, 06 Oct 2026 09:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: Bluetooth: coredump: Quiesce dump work on unregister hci_devcd_handle_pkt_init() arms dump_timeout and coredump producers queue dump_rx without holding an hdev reference. Unregister leaves both works live, so disconnecting during an active dump lets them access hdev after hci_release_dev() frees it. Shut down coredump processing during unregister. Close the producer gate under dump_q.lock before disabling both works, then free the active buffer and queued packets under hci_dev_lock. Serializing the gate with enqueue prevents controller-specific workers from adding packets after the final purge.
Title		Bluetooth: coredump: Quiesce dump work on unregister
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/24af375d7d8aa5f698e4dc41317102f44114351a https://git.kernel.org/stable/c/82699d1b727ba5980b94f1eb8dc3d346f41b7c67 https://git.kernel.org/stable/c/d236517c264e41dc09833c708ef23bccb7a91219 https://git.kernel.org/stable/c/dcaf10ef27f928568c25de3e9fc242e538de5c67

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-06T08:45:54.141Z

Updated: 2026-10-19T09:17:06.302Z

Reserved: 2026-09-25T10:25:14.337Z

Link: CVE-2026-98295

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-06T09:18:20.133

Modified: 2026-10-19T10:18:31.283

Link: CVE-2026-98295

Redhat

Severity : Moderate

Publid Date: 2026-10-06T00:00:00Z

Links: CVE-2026-98295 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-11T18:45:19Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object