CVE-2026-98297

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained

hci_send_acl(), hci_send_sco() and hci_send_iso() queue hdev->tx_work

unconditionally. They can run from the L2CAP/SCO/ISO socket send path

while hci_dev_close_sync() is draining hdev->workqueue (HCIDEVDOWN

racing with a socket write). Since that queue_work() is not chained

work from the tx_work worker itself, __queue_work() sees the queue

marked __WQ_DRAINING, warns "cannot queue %ps on wq %s", and drops

the work:

WARNING: CPU: 1 PID: 5985 at kernel/workqueue.c:2352 __queue_work

Call Trace:

queue_work_on

l2cap_chan_send

l2cap_sock_sendmsg

...

hci_dev_close_sync() already sets HCI_CMD_DRAIN_WORKQUEUE before

draining, but only hci_cmd_work() and handle_cmd_cnt_and_timer()

check it before queuing. Route the tx_work producers through the

same guard via a shared hci_sched_tx() helper.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References