CVE-2026-98633: Bluetooth: btnxpuart: Fix skb leak in nxp_process_fw_dump()
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btnxpuart: Fix skb leak in nxpprocessfwdump()
When CONFIGDEVCOREDUMP=n, hcidevcdappend() returns -EOPNOTSUPP without freeing its skb argument. This leaks the cloned skb and also prevents nxpsetindreset() from being called to perform recovery.
Fix by guarding the hcidevcdappend(hdev, skbclone(skb, GFPATOMIC)) call with ISENABLED(CONFIGDEVCOREDUMP).
Affected Software
Event History
Frequently Asked Questions
Which systems are affected by this issue?
The issue affects Linux kernel systems using the btnxpuart Bluetooth driver when the kernel is built with CONFIG_DEV_COREDUMP disabled. The affected path is triggered while processing an NXP firmware dump.
What is the operational impact if the vulnerable path is reached?
A cloned socket buffer is leaked because hci_devcd_append() returns -EOPNOTSUPP without freeing it when CONFIG_DEV_COREDUMP is disabled. The error also prevents nxp_set_ind_reset() from running, so the intended recovery action is skipped.
What configuration change mitigates the issue before a kernel update is available?
Building the kernel with CONFIG_DEV_COREDUMP enabled avoids the described disabled-core-dump behavior. The provided fix instead skips the hci_devcd_append() call when CONFIG_DEV_COREDUMP is not enabled, allowing recovery to proceed.