CVE-2026-98295: Bluetooth: coredump: Quiesce dump work on unregister

Severity: unknown
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-06 · updated 2026-10-19

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: coredump: Quiesce dump work on unregister hci_devcd_handle_pkt_init() arms dump_timeout and coredump producers queue dump_rx without holding an hdev reference. Unregister leaves both works live, so disconnecting during an active dump lets them access hdev after hci_release_dev() frees it. Shut down coredump processing during unregister. Close the producer gate under dump_q.lock before disabling both works, then free the active buffer and queued packets under hci_dev_lock. Serializing the gate with enqueue prevents controller-specific workers from adding packets after the final purge.

Affected products

Linux kernel: from 6.1.188 before 6.2; 6.4 — fixed in 6.2, 7.3

How to fix

Upgrade to a fixed version: Linux kernel 6.2, 7.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-98295 or the next vulnerability affects your stack