Executive brief
A vulnerability was identified in the Linux kernel's Bluetooth subsystem that could lead to system instability or unexpected behavior during device reset or closure. The issue occurs when the system fails to properly manage background tasks while a Bluetooth device is being shut down. This could potentially allow a local attacker to cause a denial-of-service condition by triggering specific timing issues during device management operations.
Technical details
A vulnerability in 'net/bluetooth/hci_sync.c' in the Linux kernel stems from 'hci_dev_close_sync()' failing to set the 'HCI_CMD_DRAIN_WORKQUEUE' flag. When this function is invoked during a device reset path, the absence of this flag allows new work items or timeouts to be queued while the main workqueue is attempting to drain. This race condition can lead to inconsistent state or hangs during Bluetooth stack teardown. The fix involves explicitly setting the drain flag and utilizing RCU synchronization to ensure all observers see the state change before proceeding with the device closure.
Affected products
- Linux Linux 6.0 to 6.12.92, 6.18.34, 7.0.11
Timeline
- 2026-05-26: other: Patch authored
- 2026-07-19: advisory: NVD publication date