Riskcovery

CVE-2026-98295

Bluetooth: coredump: Quiesce dump work on unregister

State
Published
Severity
Not scored
Published
Oct 6, 2026
Updated
Oct 19, 2026
Reserved
Sep 25, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: coredump: Quiesce dump work on unregister

hci_devcd_handle_pkt_init() arms dump_timeout and coredump producers queue dump_rx without holding an hdev reference. Unregister leaves both works live, so disconnecting during an active dump lets them access hdev after hci_release_dev() frees it.

Shut down coredump processing during unregister. Close the producer gate under dump_q.lock before disabling both works, then free the active buffer and queued packets under hci_dev_lock. Serializing the gate with enqueue prevents controller-specific workers from adding packets after the final purge.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 9695ef876fd122cb7bbc04a4a93b8727d2e36bda to before 24af375d7d8aa5f698e4dc41317102f44114351aAffected
  • 9695ef876fd122cb7bbc04a4a93b8727d2e36bda to before dcaf10ef27f928568c25de3e9fc242e538de5c67Affected
  • 9695ef876fd122cb7bbc04a4a93b8727d2e36bda to before 82699d1b727ba5980b94f1eb8dc3d346f41b7c67Affected
  • 9695ef876fd122cb7bbc04a4a93b8727d2e36bda to before d236517c264e41dc09833c708ef23bccb7a91219Affected
  • deb8156ebe5cb63a5988e7f86cc46aa062527c2bAffected
  • 6.1.188 to before 6.2Affected
LinuxLinux
  • 6.4Affected
  • before 6.4Not affected
  • 6.12.112 through 6.12.*Not affected
  • 6.18.54 through 6.18.*Not affected
  • 7.2.8 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.