CVE-2026-98297

Received Received - Intake

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained hci_send_acl(), hci_send_sco() and hci_send_iso() queue hdev->tx_work unconditionally. They can run from the L2CAP/SCO/ISO socket send path while hci_dev_close_sync() is draining hdev->workqueue (HCIDEVDOWN racing with a socket write). Since that queue_work() is not chained work from the tx_work worker itself, __queue_work() sees the queue marked __WQ_DRAINING, warns "cannot queue %ps on wq %s", and drops the work: WARNING: CPU: 1 PID: 5985 at kernel/workqueue.c:2352 __queue_work Call Trace: queue_work_on l2cap_chan_send l2cap_sock_sendmsg ... hci_dev_close_sync() already sets HCI_CMD_DRAIN_WORKQUEUE before draining, but only hci_cmd_work() and handle_cmd_cnt_and_timer() check it before queuing. Route the tx_work producers through the same guard via a shared hci_sched_tx() helper.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-06

EPSS Evaluated

2026-10-18

NVD

CVE-2026-98297

EUVD

EUVD-2026-93282

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	9cebe4680bb9a72f80c6541eb24af06db7a1fbc9
Linux	Linux	47330cc875b36a1cf7b3543cb2cf90a7c603ce0e
Linux	Linux	525daaea459fc215f432de1b8debbd9144bf97b0
Linux	Linux	525daaea459fc215f432de1b8debbd9144bf97b0
Linux	Linux	60bceb9a4c693e68cc90ba4b2dfb9e000e8638ff
Linux	Linux	6.12.93
Linux	Linux	6.18.35
Linux	Linux	7.0.12
Linux	Linux	7.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a race condition in the Bluetooth subsystem. Functions like hci_send_acl(), hci_send_sco(), and hci_send_iso() unconditionally queue tx_work, which can conflict with hci_dev_close_sync() draining the workqueue during device shutdown. This causes a warning and drops the work, potentially disrupting Bluetooth operations.

Detection Guidance

This vulnerability is related to the Linux kernel's Bluetooth subsystem and may not have direct network detection methods. Check kernel logs for warnings about workqueue draining or failed work queueing with commands like 'dmesg | grep -i workqueue' or 'journalctl -k | grep -i workqueue'.

Impact Analysis

This vulnerability may cause Bluetooth functionality to fail or behave unpredictably during device shutdown or when Bluetooth operations are attempted. It could lead to dropped connections, failed data transfers, or system warnings, though it does not directly impact user data or system security.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel Bluetooth subsystem issue causing workqueue warnings during race conditions, not a data breach or privacy violation.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this vulnerability. Monitor kernel updates from your distribution and apply them promptly. No specific commands are provided in the context for mitigation.

Hi! I’m here to help you understand CVE-2026-98297. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70