CVE-2026-98809
Received Received - Intake

Bluetooth Denial of Service in Linux Kernel

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: don't drain cmd_sync backlog on unregister hci_unregister_dev() disables cmd_work and cmd_timer, then calls hci_cmd_sync_clear(), whose cancel_work_sync() waits for hci_cmd_sync_work() to return. That worker dequeues and runs every entry on cmd_sync_work_list. With cmd_work disabled nothing reaches the controller, so each queued HCI command waits the full HCI_CMD_TIMEOUT (2s). The backlog has no bound. Userspace can keep queuing MGMT commands such as MGMT_OP_GET_CLOCK_INFO against a controller that doesn't answer. Closing /dev/vhci then blocks in vhci_release() for backlog * 2s: INFO: task syz-executor:5749 blocked for more than 143 seconds. cancel_work_sync hci_cmd_sync_clear hci_unregister_dev vhci_release In a local reproduction the backlog held more than 5000 entries, which comes to hours of hang. Stop the worker from taking new entries once HCI_UNREGISTER is set, and wake any request still waiting with -ENODEV before cancelling the work. The entries left over are destroyed with -ECANCELED by the existing sweep in hci_cmd_sync_clear(). They stay on the list until the work has stopped, so hci_cmd_sync_dequeue() and friends still see them. A callback already running may still issue another command, which delays unregister by at most one timeout per remaining command, not by the whole backlog.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98809
EUVD
EUVD-2026-103894

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
Linux Linux 008ee9eb8a11bcabf12c91771dd4f470b082bd44
Linux Linux 008ee9eb8a11bcabf12c91771dd4f470b082bd44
Linux Linux 008ee9eb8a11bcabf12c91771dd4f470b082bd44
Linux Linux 008ee9eb8a11bcabf12c91771dd4f470b082bd44
Linux Linux 5.17

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a Bluetooth subsystem issue where unregistering a device causes a system hang. When hci_unregister_dev() is called, it disables command processing and clears pending Bluetooth commands. However, userspace can queue many commands that never complete, leading to a backlog. Closing the device file blocks until all commands time out, potentially for hours if the backlog is large.

Detection Guidance

This vulnerability is specific to the Linux kernel's Bluetooth subsystem and may not have direct detection commands. Monitor for system hangs during Bluetooth device unregistration or high CPU usage in hci_cmd_sync_work processes. Check kernel logs for blocked tasks with messages like 'task blocked for more than X seconds' in cancel_work_sync or vhci_release contexts.

Impact Analysis

This vulnerability can cause system hangs or significant delays when unregistering Bluetooth devices, especially if many commands are queued. Users may experience unresponsive systems for extended periods, potentially leading to application crashes or denial of service.

Mitigation Strategies

Apply the latest Linux kernel security patches that address this issue. Avoid unregistering Bluetooth devices while they are actively processing commands. Monitor for and terminate any hanging processes related to Bluetooth subsystems. Restrict unprivileged access to Bluetooth management interfaces.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98809. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart