{"id":"CVE-2026-98633","kind":"vulnerability","aliases":["CVE-2026-98633"],"related":[],"title":"Linux kernel Bluetooth btnxpuart: skb leak on firmware dump","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btnxpuart: Fix skb leak in nxp_process_fw_dump()\n\nWhen CONFIG_DEV_COREDUMP=n, hci_devcd_append() returns -EOPNOTSUPP\nwithout freeing its skb argument. This leaks the cloned skb and also\nprevents nxp_set_ind_reset() from being called to perform recovery.\n\nFix by guarding the hci_devcd_append(hdev, skb_clone(skb, GFP_ATOMIC))\ncall with IS_ENABLED(CONFIG_DEV_COREDUMP).","summary":"In the Linux kernel's btnxpuart Bluetooth driver, a kernel built without CONFIG_DEV_COREDUMP leaks a cloned socket buffer when a firmware dump is processed, and recovery is skipped. The sources describe a memory leak and a missed recovery step, not code execution or data exposure.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bluetooth","embedded","infrastructure","linux-kernel"],"not_affected_if":["btnxpuart-not-loaded","coredump-enabled"],"how_to_check":"- Check whether the kernel was built with `CONFIG_DEV_COREDUMP` disabled, for example with `grep CONFIG_DEV_COREDUMP /boot/config-$(uname -r)`\n- Check whether the NXP btnxpuart Bluetooth driver is loaded with `lsmod | grep btnxpuart`","fix":"- Update the Linux kernel to a release that includes the upstream fix for btnxpuart (the sources do not name a version: unknown)","status":"open","published_at":"2026-10-18T16:17:16+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:21:02+00:00","updated_at":"2026-10-25T05:21:02+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T05:21:02Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream fix for btnxpuart (the sources do not name a version: unknown)","reach":"local","title":"Linux kernel Bluetooth btnxpuart: skb leak on firmware dump","impact":"low","summary":"In the Linux kernel's btnxpuart Bluetooth driver, a kernel built without CONFIG_DEV_COREDUMP leaks a cloned socket buffer when a firmware dump is processed, and recovery is skipped. The sources describe a memory leak and a missed recovery step, not code execution or data exposure.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","bluetooth","embedded"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Kernel memory leaks and Bluetooth recovery is skipped","analyst_note":"","how_to_check":"- Check whether the kernel was built with `CONFIG_DEV_COREDUMP` disabled, for example with `grep CONFIG_DEV_COREDUMP /boot/config-$(uname -r)`\n- Check whether the NXP btnxpuart Bluetooth driver is loaded with `lsmod | grep btnxpuart`","needs_analyst":false,"not_affected_if":["btnxpuart-not-loaded","coredump-enabled"],"who_is_affected":"Systems running a Linux kernel with the NXP btnxpuart Bluetooth driver and CONFIG_DEV_COREDUMP disabled, typically embedded boards with NXP Bluetooth chips. Systems without that driver loaded, or with coredump support enabled, are not affected by this path.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000651,"input_tokens":3437,"output_tokens":615,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-98633':12A,15A 'also':110C 'append':96C,128C 'argument':103C 'atom':134C 'bluetooth':3A,16B,28B,79C 'btnxpuart':4A,27B,80C 'buffer':41B 'built':32B 'call':118C,135C 'clone':39B,107C,131C 'code':64B 'config':34B,90C,139C 'coredump':36B,92C,141C 'cve':10A,13A 'data':67B 'describ':54B 'dev':35B,91C,140C 'devcd':95C,127C 'driver':29B 'dump':9A,45B,88C 'embed':17B 'enabl':138C 'eopnotsupp':98C 'execut':65B 'exposur':68B 'firmwar':8A,44B 'fix':81C,122C 'follow':74C 'free':100C 'fw':87C 'gfp':133C 'guard':124C 'hci':94C,126C 'hdev':129C 'ind':114C 'infrastructur':18B 'kernel':2A,21B,25B,31B,72C 'leak':6A,37B,57B,83C,105C 'linux':1A,20B,24B,71C 'linux-kernel':19B 'memori':56B 'miss':60B 'n':93C 'nxp':85C,112C 'perform':120C 'prevent':111C 'process':47B,86C 'recoveri':49B,61B,121C 'reset':115C 'resolv':78C 'return':97C 'set':113C 'skb':5A,82C,102C,108C,130C,132C 'skip':51B 'socket':40B 'sourc':53B 'step':62B 'vulner':75C 'without':33B,99C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the NXP btnxpuart Bluetooth driver and CONFIG_DEV_COREDUMP disabled, typically embedded boards with NXP Bluetooth chips. Systems without that driver loaded, or with coredump support enabled, are not affected by this path.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:16+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98633","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98633","severity":null,"published_at":"2026-10-18T16:17:16+00:00","modified_at":"2026-10-19T10:19:27+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}