{"schema":"threatline.record/2","record":{"id":"CVE-2026-98297","aliases":[],"summary":"Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_core: Fix queuing tx_work after workqueue is drained\n\nhci_send_acl(), hci_send_sco() and hci_send_iso() queue hdev->tx_work\nunconditionally. They can run from the L2CAP/SCO/ISO socket send path\nwhile hci_dev_close_sync() is draining hdev->workqueue (HCIDEVDOWN\nracing with a socket write). Since that queue_work() is not chained\nwork from the tx_work worker itself, __queue_work() sees the queue\nmarked __WQ_DRAINING, warns \"cannot queue %ps on wq %s\", and drops\nthe work:\n\n  WARNING: CPU: 1 PID: 5985 at kernel/workqueue.c:2352 __queue_work\n  Call Trace:\n   queue_work_on\n   l2cap_chan_send\n   l2cap_sock_sendmsg\n   ...\n\nhci_dev_close_sync() already sets HCI_CMD_DRAIN_WORKQUEUE before\ndraining, but only hci_cmd_work() and handle_cmd_cnt_and_timer()\ncheck it before queuing. Route the tx_work producers through the\nsame guard via a shared hci_sched_tx() helper.","categories":["Operating systems"],"product":"Linux","vendor":"Linux","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98297","source_modified_at":"2026-10-21T12:54:55.978Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Linux","vendor":"Linux","versions":[{"version":"7b81c1378b79c3143ca3fdb3d18ac0f01cbabb21","lessThan":"8010212197d4a3ee714f78ed77048d0b712ff925","status":"affected","versionType":"git"},{"version":"9cebe4680bb9a72f80c6541eb24af06db7a1fbc9","lessThan":"ab0678a0701ac4de499428dc1b321659bb74d272","status":"affected","versionType":"git"},{"version":"47330cc875b36a1cf7b3543cb2cf90a7c603ce0e","lessThan":"e220c1242a643d97102a79f09b7ef3aa31276961","status":"affected","versionType":"git"},{"version":"525daaea459fc215f432de1b8debbd9144bf97b0","lessThan":"cbb325bc150e8c0dbce004ac0e5516bcffc0de31","status":"affected","versionType":"git"},{"version":"525daaea459fc215f432de1b8debbd9144bf97b0","lessThan":"6610c6fe4b8936c232048e6049bf77c70a6f759c","status":"affected","versionType":"git"},{"version":"60bceb9a4c693e68cc90ba4b2dfb9e000e8638ff","status":"affected","versionType":"git"},{"version":"6.12.93","lessThan":"6.12.112","status":"affected","versionType":"semver"},{"version":"6.18.35","lessThan":"6.18.54","status":"affected","versionType":"semver"},{"version":"7.0.12","lessThan":"7.1","status":"affected","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98297","source_modified_at":"2026-10-21T12:54:55.978Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Linux","vendor":"Linux","versions":[{"version":"7.1","status":"affected"},{"version":"0","lessThan":"7.1","status":"unaffected","versionType":"semver"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","status":"unaffected","versionType":"semver"},{"version":"7.3","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}],"defaultStatus":"affected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98297","source_modified_at":"2026-10-21T12:54:55.978Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"8010212197d4a3ee714f78ed77048d0b712ff925","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98297","source_modified_at":"2026-10-21T12:54:55.978Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"6610c6fe4b8936c232048e6049bf77c70a6f759c","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98297","source_modified_at":"2026-10-21T12:54:55.978Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"6.12.112","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98297","source_modified_at":"2026-10-21T12:54:55.978Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"6.18.54","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98297","source_modified_at":"2026-10-21T12:54:55.978Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"7.1","basis":"first unaffected version stated in the CVE record"}],"cvss":null,"severity":null,"kev":{"listed":false},"epss":{"probability":0.00175,"percentile":0.06678,"score_date":"2026-10-23"},"published_at":"2026-10-06T08:45:55.723Z","modified_at":"2026-10-21T12:54:55.978Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-98297","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-21T12:54:55.978Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98297","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://git.kernel.org/stable/c/8010212197d4a3ee714f78ed77048d0b712ff925"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/ab0678a0701ac4de499428dc1b321659bb74d272"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/e220c1242a643d97102a79f09b7ef3aa31276961"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/cbb325bc150e8c0dbce004ac0e5516bcffc0de31"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/6610c6fe4b8936c232048e6049bf77c70a6f759c"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-21T12:54:55.978Z","content_hash":"978e62cb61f18f11cbcce781896e4a1ae2333d1bff8a9134bae369f9632478c1"}}