CVE-2026-98109

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_core: Fix race condition during device registration

In hci_register_dev(), the power_on work item is queued to

hdev->req_workqueue before initializing hdev->adv_monitors_idr and

registering the MSFT extension via msft_register(). For devices marked with

quirks such as HCI_QUIRK_RAW_DEVICE, the HCI_UNCONFIGURED flag is set on

the device. When the power_on work item runs concurrently on another CPU,

hci_power_on() detects that the device is unconfigured and immediately

invokes hci_dev_do_close(), which calls msft_do_close().

Concurrently, msft_register() allocates the msft structure and exposes it

to hdev->msft_data prior to calling mutex_init(&msft->filter_lock). If

msft_do_close() executes while hdev->msft_data is already assigned but the

mutex has not yet been initialized, mutex_lock(&msft->filter_lock) operates

on an uninitialized mutex, triggering a DEBUG_LOCKS warning:

DEBUG_LOCKS_WARN_ON(lock->m

/// Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// Affected products

/// References