CVE-2026-68085
Received Received - Intake

Bluetooth: hci_uart HCI_UART_SENDING Clear on Work Cancel

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled HCI_UART_SENDING bit in tx_state means write_work is pending and blocks queueing it again. Currently this bit is not cleared when canceling the work in hci_uart_close(), which blocks future writes when device is reopened later if write_work was pending. Fix by clearing HCI_UART_SENDING when canceling the work. Also make clearing of tx_skb safe by using disable_work_sync + enable_work instead of just cancel_work_sync. hci_uart_flush() purges the proto tx queue so we can cancel the pending write_work there, instead of doing it just in hci_uart_close(). Re-enable and possibly requeue the work after queue flush.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-68085
EUVD
EUVD-2026-55266

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel Bluetooth vulnerability where the HCI_UART_SENDING flag is not cleared when write_work is canceled. This flag blocks new write operations. When a device is reopened after being closed with a pending write, future writes are blocked even though the work was canceled.

Detection Guidance

This vulnerability is specific to the Linux kernel's Bluetooth HCI UART driver and may not have direct network detection methods. Check kernel logs for Bluetooth-related errors or warnings using: dmesg | grep -i bluetooth or journalctl -k | grep -i bluetooth. Verify if the HCI_UART_SENDING bit issue exists by inspecting kernel source or running a patched kernel version.

Impact Analysis

If you use Bluetooth devices with a vulnerable Linux kernel, this issue could prevent Bluetooth communication after reopening a device if a write operation was pending when closed. It may cause Bluetooth functionality to fail intermittently.

Mitigation Strategies

Apply the latest Linux kernel update that includes the fix for this vulnerability. Reboot the system to ensure the patched kernel is active. Monitor Bluetooth functionality after the update to confirm normal operation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68085. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart