In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Fix skb leak in nxp_process_fw_dump() When… (CVE-2026-98633)

The Linux kernel Bluetooth btnxpuart driver had a flaw where, if CONFIG_DEV_COREDUMP was set to 'n', the function hci_devcd_append() returned -EOPNOTSUPP without freeing its skb argument. This caused a cloned skb memory leak and blocked the nxp_set_ind_reset() recovery function from executing. The fix involves guarding the call to hci_devcd_append() with a check for CONFIG_DEV_COREDUMP being enabled, preventing the leak and ensuring proper recovery.

The vulnerability results in a memory leak of cloned socket buffers in the Bluetooth btnxpuart driver when CONFIG_DEV_COREDUMP is disabled. Additionally, it prevents a recovery function from being called, which could affect device stability or recovery processes related to Bluetooth firmware dumps. There is no indication of remote code execution or privilege escalation from the provided data.

A fix is available and has been applied in the Linux kernel to guard the problematic function call with a configuration check. Users should update to the patched kernel version containing this fix. No additional mitigation is indicated.