UBUNTU-CVE-2026-98295: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: coredump: Quiesce dump work on unregister hcidevcdhandlepktinit() arms dumptimeout and coredump producers queue dumprx without holding an hdev reference. Unregister leaves both works live, so disconnecting during an active dump lets them access hdev after hcireleasedev() frees it. Shut down coredump processing during unregister. Close the producer gate under dumpq.lock before disabling both works, then free the active buffer and queued packets under hcidevlock. Serializing the gate with enqueue prevents controller-specific workers from adding packets after the final purge.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Operational
During hci_dev unregister, shut down Bluetooth coredump processing: close the producer gate under dump_q.lock before disabling both dump works, serialize the gate with dump_rx enqueue so controller-specific workers cannot add packets after the final purge, then free the active buffer and queued packets under hci_dev_lock.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems running one of the listed Ubuntu kernel packages may be exposed when Bluetooth coredump processing is active and an HCI device is disconnected or unregistered during an active dump.
What condition is required to trigger the vulnerability?
A Bluetooth coredump must be active, with dump timeout or receive work still queued, when the HCI device is unregistered. The queued work can then access the device after it has been freed.
What is the relevant mitigation if an updated kernel cannot be deployed immediately?
The provided information identifies the risky condition as disconnecting or unregistering a Bluetooth HCI device during active coredump processing. Avoiding that condition reduces exposure, but no complete workaround is specified.