Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained
Summary
| CVE | CVE-2026-98297 |
|---|---|
| State | PUBLISHED |
| Assigner | Linux |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-10-06 09:18:20 UTC |
| Updated | 2026-10-06 09:18:20 UTC |
| Description | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained hci_send_acl(), hci_send_sco() and hci_send_iso() queue hdev->tx_work unconditionally. They can run from the L2CAP/SCO/ISO socket send path while hci_dev_close_sync() is draining hdev->workqueue (HCIDEVDOWN racing with a socket write). Since that queue_work() is not chained work from the tx_work worker itself, __queue_work() sees the queue marked __WQ_DRAINING, warns "cannot queue %ps on wq %s", and drops the work: WARNING: CPU: 1 PID: 5985 at kernel/workqueue.c:2352 __queue_work Call Trace: queue_work_on l2cap_chan_send l2cap_sock_sendmsg ... hci_dev_close_sync() already sets HCI_CMD_DRAIN_WORKQUEUE before draining, but only hci_cmd_work() and handle_cmd_cnt_and_timer() check it before queuing. Route the tx_work producers through the same guard via a shared hci_sched_tx() helper. |
Risk And Classification
EPSS: 0.001750000 probability, percentile 0.063810000 (date 2026-10-06)
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Linux | Linux | affected 9cebe4680bb9a72f80c6541eb24af06db7a1fbc9 ab0678a0701ac4de499428dc1b321659bb74d272 git | Not specified |
| CNA | Linux | Linux | affected 47330cc875b36a1cf7b3543cb2cf90a7c603ce0e e220c1242a643d97102a79f09b7ef3aa31276961 git | Not specified |
| CNA | Linux | Linux | affected 525daaea459fc215f432de1b8debbd9144bf97b0 cbb325bc150e8c0dbce004ac0e5516bcffc0de31 git | Not specified |
| CNA | Linux | Linux | affected 525daaea459fc215f432de1b8debbd9144bf97b0 6610c6fe4b8936c232048e6049bf77c70a6f759c git | Not specified |
| CNA | Linux | Linux | affected 60bceb9a4c693e68cc90ba4b2dfb9e000e8638ff git | Not specified |
| CNA | Linux | Linux | affected 6.12.93 6.12.112 semver | Not specified |
| CNA | Linux | Linux | affected 6.18.35 6.18.54 semver | Not specified |
| CNA | Linux | Linux | affected 7.0.12 7.1 semver | Not specified |
| CNA | Linux | Linux | affected 7.1 | Not specified |
| CNA | Linux | Linux | unaffected 7.1 semver | Not specified |
| CNA | Linux | Linux | unaffected 6.12.112 6.12.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.18.54 6.18.* semver | Not specified |
| CNA | Linux | Linux | unaffected 7.2.8 7.2.* semver | Not specified |
| CNA | Linux | Linux | unaffected 7.3-rc4 * original_commit_for_fix | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| git.kernel.org/stable/c/ab0678a0701ac4de499428dc1b321659bb74d272 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/cbb325bc150e8c0dbce004ac0e5516bcffc0de31 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/e220c1242a643d97102a79f09b7ef3aa31276961 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/6610c6fe4b8936c232048e6049bf77c70a6f759c | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.