All vulnerabilities
CVE-2026-98297

Linux: Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.18%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in8010212197d4a3ee714f78ed77048d0b712ff925Also 6610c6fe4b8936c232048e6049bf77c70a6f759c, 6.12.112 and 2 moreCVE List
Published6 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained

hci_send_acl(), hci_send_sco() and hci_send_iso() queue hdev->tx_work unconditionally. They can run from the L2CAP/SCO/ISO socket send path while hci_dev_close_sync() is draining hdev->workqueue (HCIDEVDOWN racing with a socket write). Since that queue_work() is not chained work from the tx_work worker itself, __queue_work() sees the queue marked __WQ_DRAINING, warns "cannot queue %ps on wq %s", and drops the work:

WARNING: CPU: 1 PID: 5985 at kernel/workqueue.c:2352 __queue_work Call Trace: queue_work_on l2cap_chan_send l2cap_sock_sendmsg ...

hci_dev_close_sync() already sets HCI_CMD_DRAIN_WORKQUEUE before draining, but only hci_cmd_work() and handle_cmd_cnt_and_timer() check it before queuing. Route the tx_work producers through the same guard via a shared hci_sched_tx() helper.

Text from CVE List

Affected versions 15

  • Linuxaffected: 7b81c1378b79c3143ca3fdb3d18ac0f01cbabb21 before 8010212197d4a3ee714f78ed77048d0b712ff925CVE List
  • Linuxaffected: 9cebe4680bb9a72f80c6541eb24af06db7a1fbc9 before ab0678a0701ac4de499428dc1b321659bb74d272CVE List
  • Linuxaffected: 47330cc875b36a1cf7b3543cb2cf90a7c603ce0e before e220c1242a643d97102a79f09b7ef3aa31276961CVE List
  • Linuxaffected: 525daaea459fc215f432de1b8debbd9144bf97b0 before cbb325bc150e8c0dbce004ac0e5516bcffc0de31CVE List
  • Linuxaffected: 525daaea459fc215f432de1b8debbd9144bf97b0 before 6610c6fe4b8936c232048e6049bf77c70a6f759cCVE List
  • Linuxaffected: 60bceb9a4c693e68cc90ba4b2dfb9e000e8638ffCVE List
  • Linuxaffected: 6.12.93 before 6.12.112CVE List
  • Linuxaffected: 6.18.35 before 6.18.54CVE List
  • Linuxaffected: 7.0.12 before 7.1CVE List
  • Linuxaffected: 7.1CVE List
  • Linuxunaffected: all versions before 7.1CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.54 through 6.18.*CVE List
  • Linuxunaffected: 7.2.8 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5