CVE-2026-98295

Received Received - Intake

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: coredump: Quiesce dump work on unregister hci_devcd_handle_pkt_init() arms dump_timeout and coredump producers queue dump_rx without holding an hdev reference. Unregister leaves both works live, so disconnecting during an active dump lets them access hdev after hci_release_dev() frees it. Shut down coredump processing during unregister. Close the producer gate under dump_q.lock before disabling both works, then free the active buffer and queued packets under hci_dev_lock. Serializing the gate with enqueue prevents controller-specific workers from adding packets after the final purge.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-06

EPSS Evaluated

2026-10-18

NVD

CVE-2026-98295

EUVD

EUVD-2026-93280

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	9695ef876fd122cb7bbc04a4a93b8727d2e36bda
Linux	Linux	9695ef876fd122cb7bbc04a4a93b8727d2e36bda
Linux	Linux	9695ef876fd122cb7bbc04a4a93b8727d2e36bda
Linux	Linux	9695ef876fd122cb7bbc04a4a93b8727d2e36bda
Linux	Linux	deb8156ebe5cb63a5988e7f86cc46aa062527c2b
Linux	Linux	6.1.188
Linux	Linux	6.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves Bluetooth core dump handling. When a Bluetooth device unregisters, its dump work and coredump producers remain active and can access freed memory. The issue occurs because the device reference is not held during dump operations, allowing workers to access the device after it has been released, potentially leading to use-after-free conditions.

Detection Guidance

This vulnerability is specific to the Linux kernel's Bluetooth subsystem and may not have direct network detection commands. Check kernel logs for Bluetooth-related errors or crashes using 'dmesg | grep -i bluetooth' or 'journalctl -k | grep -i bluetooth'. Ensure your kernel version is up-to-date to confirm if the fix is applied.

Impact Analysis

An attacker could exploit this to cause system crashes, execute arbitrary code, or escalate privileges by triggering a Bluetooth device disconnect during an active core dump. This may lead to denial-of-service or unauthorized access on affected systems.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel Bluetooth component issue that could lead to memory corruption or crashes if exploited, but no evidence suggests it impacts data privacy or security controls required by these regulations.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this vulnerability. If immediate patching is not possible, disable Bluetooth functionality temporarily until the update is applied to prevent potential exploitation.

Hi! I’m here to help you understand CVE-2026-98295. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70