UBUNTU-CVE-2026-98633: Low severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Fix skb leak in nxpprocessfwdump() When CONFIGDEVCOREDUMP=n, hcidevcdappend() returns -EOPNOTSUPP without freeing its skb argument. This leaks the cloned skb and also prevents nxpsetindreset() from being called to perform recovery. Fix by guarding the hcidevcdappend(hdev, skbclone(skb, GFPATOMIC)) call with ISENABLED(CONFIGDEVCOREDUMP).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Configuration
Guard the hci_devcd_append(hdev, skb_clone(skb, GFP_ATOMIC)) call with IS_ENABLED(CONFIG_DEV_COREDUMP).
Linux kernel Bluetooth btnxpuart CONFIG_DEV_COREDUMP = IS_ENABLED(CONFIG_DEV_COREDUMP)
Event History
Frequently Asked Questions
Which systems are affected by this issue?
The affected Ubuntu kernel packages listed are linux-riscv, linux-realtime, linux-hwe-edge, linux-azure, linux-gcp, linux-azure-fde, linux-gke, and linux-aws-5.0. The issue is specific to the Bluetooth btnxpuart driver handling firmware dumps.
What configuration is required for the leak and failed recovery to occur?
The issue occurs when the kernel is built with CONFIG_DEV_COREDUMP disabled. In that configuration, hci_devcd_append() returns -EOPNOTSUPP without freeing the cloned skb, and the reset recovery path is not reached.
What is the operational impact if this condition is triggered?
A cloned socket buffer is leaked during firmware-dump processing, and nxp_set_ind_reset() is not called. This can prevent the intended recovery action after the firmware-dump handling path.