Description
In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btnxpuart: Fix skb leak in nxp_process_fw_dump()

When CONFIG_DEV_COREDUMP=n, hci_devcd_append() returns -EOPNOTSUPP
without freeing its skb argument. This leaks the cloned skb and also
prevents nxp_set_ind_reset() from being called to perform recovery.

Fix by guarding the hci_devcd_append(hdev, skb_clone(skb, GFP_ATOMIC))
call with IS_ENABLED(CONFIG_DEV_COREDUMP).
Published: 2026-10-18
Score: 1.9 Low
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service (Memory Exhaustion)
Action: Apply Patch
AI Analysis

Impact

A kernel bug in the Bluetooth btnxpuart driver causes an skb memory buffer to leak when the core dump feature is disabled, preventing nxp_set_ind_reset() from executing and potentially leading to kernel memory exhaustion. This is a classic memory‑management flaw that can degrade system availability.

Affected Systems

The flaw is present in the Linux kernel’s Bluetooth btnxpuart driver, affecting all builds that enable the driver and have CONFIG_DEV_COREDUMP set to "n". No specific version list is provided, but any kernel incorporating the unpatched driver is vulnerable.

Risk and Exploitability

The CVSS score of 1.9 and the EPSS score of <1% indicate a low severity vulnerability. The functional impact of leaking a kernel skb and preventing device recovery could degrade system stability, yet the low EPSS score suggests a low likelihood of exploitation. Because the flaw is triggered via Bluetooth commands, it can be exploited remotely over a wireless interface, likely without requiring elevated privileges. The vulnerability is not listed in the CISA KEV catalog, indicating it may not yet be actively exploited in the wild.

Generated by OpenCVE AI on October 22, 2026 at 21:30 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply a kernel update that includes the commit fixing the leak (e.g. the patch adding the IS_ENABLED(CONFIG_DEV_COREDUMP) guard).
  • Reconfigure the kernel to enable the CONFIG_DEV_COREDUMP option so that the guard is exercised and the skb is freed.
  • Disable or restrict the Bluetooth hardware interface if the system does not require it, or isolate it to a non‑trusted domain.

Generated by OpenCVE AI on October 22, 2026 at 21:30 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 22 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-772
References
Metrics threat_severity

None

 cvssV3_1

{'score': 1.9, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L'}

threat_severity

Low

Sun, 18 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Fix skb leak in nxp_process_fw_dump() When CONFIG_DEV_COREDUMP=n, hci_devcd_append() returns -EOPNOTSUPP without freeing its skb argument. This leaks the cloned skb and also prevents nxp_set_ind_reset() from being called to perform recovery. Fix by guarding the hci_devcd_append(hdev, skb_clone(skb, GFP_ATOMIC)) call with IS_ENABLED(CONFIG_DEV_COREDUMP).
Title Bluetooth: btnxpuart: Fix skb leak in nxp_process_fw_dump()
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-10-19T09:23:02.041Z

Reserved: 2026-09-25T10:25:14.361Z

Link: CVE-2026-98633

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-18T16:17:16.410

Modified: 2026-10-19T10:19:27.567

Link: CVE-2026-98633

cve-icon Redhat

Severity : Low

Publid Date: 2026-10-18T00:00:00Z

Links: CVE-2026-98633 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T21:45:06Z

Weaknesses
  • CWE-772

    Missing Release of Resource after Effective Lifetime