CVE-2026-98295

A flaw was found in the Linux kernel's Bluetooth subsystem. A local user can cause a Denial of Service (DoS) or memory corruption by disconnecting a Bluetooth device during an active diagnostic crash dump. Because the system fails to cancel pending dump tasks upon device unregistration, background processes attempt to access the device data structure after it has been freed from memory, triggering a use-after-free condition.

A race in the Bluetooth device coredump lifecycle allows dump_rx or dump_timeout work to remain active while an hci_dev is being unregistered and freed. Disconnecting or unregistering a controller during an active dump can therefore cause asynchronous work or a controller specific producer to access the released hci_dev, resulting in a use after free and at least a kernel crash. For the CVSS the PR:L in the paranoid score accounts for environments where a restricted service, container root, delegated Bluetooth capability, or virtual HCI access can initiate the affected lifecycle without full host administration. AC:H applies because successful triggering depends on winning the timing window between active coredump processing and device teardown. The issue is not directly reachable through ordinary remote Bluetooth traffic based on the supplied code, although a controlled controller or driver specific producer may influence the timing. Impact is at least local denial of service and may include confidentiality, integrity, or privilege escalation impact if the stale hci_dev access can be converted into controlled memory corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.