Memory leak in Linux kernel - CVE-2026-98633

Vulnerability identifier: #VU156944

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-98633

CWE-ID: CWE-401

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to potentially cause a denial of service through kernel memory leaks and failed Bluetooth device recovery.

The vulnerability exists due to a failure to release cloned socket buffers in the Linux kernel Bluetooth btnxpuart driver's nxp_process_fw_dump() function when processing firmware dumps. A local user can potentially trigger affected firmware dump processing to leak memory and prevent nxp_set_ind_reset() from performing recovery, disrupting Bluetooth device operation.

The issue occurs when device coredump support is disabled with CONFIG_DEV_COREDUMP=n.

Linux kernel
Ubuntu
linux (Ubuntu package)
linux-aws (Ubuntu package)
linux-gcp (Ubuntu package)
linux-oracle (Ubuntu package)
linux-ibm (Ubuntu package)
linux-hwe-7.0 (Ubuntu package)
linux-oem-7.0 (Ubuntu package)

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux (Ubuntu package) - update to 7.0.0-42.42
linux-aws (Ubuntu package) - update to 7.0.0-1016.17
linux-gcp (Ubuntu package) - update to 7.0.0-1016.18
linux-oracle (Ubuntu package) - update to 7.0.0-1015.16
linux-ibm (Ubuntu package) - update to 7.0.0-1017.17
linux-hwe-7.0 (Ubuntu package) - update to 7.0.0-42.42~24.04.1
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1017.17

• https://git.kernel.org/stable/c/8a36598050cd1e5abb1d5ed42cc224cfcb538c4f
• https://git.kernel.org/stable/c/edcb84ee607a9ddfc6f2771a7f399115f0b0f19d
• https://git.kernel.org/stable/c/f2bbb36426581045a8bf7793da5419b9375e4348

• Memory leak in Linux kernel bluetooth driver
• Ubuntu update for linux-oem-7.0
• Ubuntu update for linux, linux-aws, linux-gcp and more