CVE-2026-98295
Last modified
CVE-2026-98295 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: Bluetooth: coredump: Quiesce dump work on unregister hci_devcd_handle_pkt_init() arms dump_timeout and coredump producers queue dump_rx without holding an hdev reference. Unregister leaves both works live, so disconnecting during an active dump lets them access hdev after hci_release_dev() frees it. Shut down coredump processing during unregister.
Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: coredump: Quiesce dump work on unregister hci_devcd_handle_pkt_init() arms dump_timeout and coredump producers queue dump_rx without holding an hdev reference. Unregister leaves both works live, so disconnecting during an active dump lets them access hdev after hci_release_dev() frees it. Shut down coredump processing during unregister. Close the producer gate under dump_q.lock before disabling both works, then free the active buffer and queued packets under hci_dev_lock. Serializing the gate with enqueue prevents controller-specific workers from adding packets after the final purge.
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | >= 9695ef876fd122cb7bbc04a4a93b8727d2e36bda, < 24af375d7d8aa5f698e4dc41317102f44114351a; >= 9695ef876fd122cb7bbc04a4a93b8727d2e36bda, < dcaf10ef27f928568c25de3e9fc242e538de5c67; >= 9695ef876fd122cb7bbc04a4a93b8727d2e36bda, < 82699d1b727ba5980b94f1eb8dc3d346f41b7c67; >= 9695ef876fd122cb7bbc04a4a93b8727d2e36bda, < d236517c264e41dc09833c708ef23bccb7a91219; deb8156ebe5cb63a5988e7f86cc46aa062527c2b; >= 6.1.188, < 6.2 |
| Linux | Linux | 6.4 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-98295?
How severe is CVE-2026-98295?
How do I fix CVE-2026-98295?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-9829The Photo Gallery by 10Web – Mobile-Friendly Image Gallery p…6.5
- CVE-2026-98290In the Linux kernel, the following vulnerability has been re…7.5
- CVE-2026-98291In the Linux kernel, the following vulnerability has been re…
- CVE-2026-98292In the Linux kernel, the following vulnerability has been re…
- CVE-2026-98293In the Linux kernel, the following vulnerability has been re…
- CVE-2026-98294In the Linux kernel, the following vulnerability has been re…
- CVE-2026-98296In the Linux kernel, the following vulnerability has been re…
- CVE-2026-98297In the Linux kernel, the following vulnerability has been re…
- CVE-2026-98298In the Linux kernel, the following vulnerability has been re…
- CVE-2026-98299In the Linux kernel, the following vulnerability has been re…
- CVE-2026-9830The bookingpress-appointment-booking-pro WordPress plugin be…8.2
- CVE-2026-98300In the Linux kernel, the following vulnerability has been re…
Are you affected by CVE-2026-98295?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST