In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: coredump: Quiesce dump work on unregister

hci devcd handle pkt init() arms dump timeout and coredump producers queue dump rx without holding an hdev reference. Unregister leaves both works live, so disconnecting during an active dump lets them access hdev after hci release dev() frees it.

Shut down coredump processing during unregister. Close the producer gate under dump q.lock before disabling both works, then free the active buffer and queued packets under hci dev lock. Serializing the gate with enqueue prevents controller-specific workers from adding packets after the final purge.