CVE-2026-98633 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btnxpuart: Fix skb leak in nxp_process_fw_dump()
When CONFIG_DEV_COREDUMP=n, hci_devcd_append() returns -EOPNOTSUPP without freeing its skb argument. This leaks the cloned skb and also prevents nxp_set_ind_reset() from being called to perform recovery.
Fix by guarding the hci_devcd_append(hdev, skb_clone(skb, GFP_ATOMIC)) call with IS_ENABLED(CONFIG_DEV_COREDUMP).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/19/2026
The Linux kernel Bluetooth subsystem contains a resource management flaw within the NXP UART driver component specifically located in the nxp_process_fw_dump function. This vulnerability arises from an improper handling of socket buffer objects when certain configuration options are disabled during kernel compilation. The core issue is triggered under specific conditional logic where the development coredump feature, controlled by the CONFIG_DEV_COREDUMP setting, is not enabled. In this state, the system attempts to append data for diagnostic purposes using the hci_devcd_append function, which serves as an interface for capturing hardware debug information. However, when this configuration option is disabled, the underlying implementation of hci_devcd_append does not perform necessary cleanup operations on its input arguments before returning an error code indicating that the operation is not supported.
The technical flaw centers on a memory leak and subsequent operational failure in the driver's firmware dump processing routine. When CONFIG_DEV_COREDUMP is set to n, any call to hci_devcd_append results in the function returning -EOPNOTSUPP without freeing the socket buffer skb that was passed as an argument. This leads directly to a kernel memory leak because the cloned skb allocated earlier in the nxp_process_fw_dump routine remains unreleased and accumulates over time if such events occur repeatedly. Beyond the immediate resource exhaustion risk, this defect disrupts the driver's internal state machine logic. The failure to free the buffer is coupled with a logical bypass that prevents the invocation of nxp_set_ind_reset. This function is critical for performing hardware recovery procedures after firmware dump operations are attempted or completed.
The operational impact of this vulnerability extends beyond simple memory consumption. By preventing the execution of nxp_set_ind_reset, the driver fails to properly reset the NXP Bluetooth controller following a failed or unsupported coredump attempt. This can leave the Bluetooth interface in an unstable state, potentially causing connectivity issues, failure to re-establish links with peripheral devices, or requiring a full system reboot to restore normal functionality. In environments where high availability is required, such as industrial IoT deployments or critical infrastructure relying on wireless communication, this instability poses a significant risk to service continuity. The memory leak itself contributes to long-term kernel degradation, potentially leading to out-of-memory conditions in resource-constrained embedded systems if the condition persists over extended periods of operation with frequent firmware interactions.
From a classification perspective, this vulnerability aligns with CWE-401, which describes missing release of memory after effective usage. The failure to free dynamically allocated resources like socket buffers is a classic example of improper cleanup leading to resource exhaustion. Additionally, the disruption of recovery mechanisms can be viewed through the lens of availability impacts found in various security frameworks, although it primarily represents a reliability issue rather than an exploitable attack vector for privilege escalation or remote code execution. The ATT&CK framework does not directly map this specific kernel bug to a tactical technique as it is not an adversary action but rather a software defect affecting system stability and resource management integrity within the operating system core.
Mitigation strategies focus on applying the upstream kernel patch that corrects the conditional logic surrounding the hci_devcd_append call. The fix involves guarding the function invocation with IS_ENABLED(CONFIG_DEV_COREDUMP) to ensure that socket buffer cloning only occurs when the coredump feature is actually active and capable of handling the data. This prevents both the memory leak by avoiding unnecessary allocations in unsupported configurations and ensures that subsequent recovery steps are not bypassed due to early returns from failed append operations. System administrators should apply this update as part of their regular kernel maintenance cycle, particularly for systems utilizing NXP Bluetooth UART interfaces where firmware diagnostics or coredump features might be toggled during development or debugging phases. Regular monitoring of memory usage in long-running embedded devices can help detect any residual leakage if the patch has not yet been deployed.