SB20261022218 - Memory leak in Linux kernel bluetooth driver

Description

This security bulletin contains information about 1 vulnerability.

1) Memory leak (CVE-ID: CVE-2026-98633)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through kernel memory leaks and failed Bluetooth device recovery.

The vulnerability exists due to a failure to release cloned socket buffers in the Linux kernel Bluetooth btnxpuart driver's nxp_process_fw_dump() function when processing firmware dumps. A local user can potentially trigger affected firmware dump processing to leak memory and prevent nxp_set_ind_reset() from performing recovery, disrupting Bluetooth device operation.

The issue occurs when device coredump support is disabled with CONFIG_DEV_COREDUMP=n.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/8a36598050cd1e5abb1d5ed42cc224cfcb538c4f
• https://git.kernel.org/stable/c/edcb84ee607a9ddfc6f2771a7f399115f0b0f19d
• https://git.kernel.org/stable/c/f2bbb36426581045a8bf7793da5419b9375e4348