Executive brief
The Linux kernel's Bluetooth UART driver contains a race condition in device close and reinit sequences. When a Bluetooth device is closed while a pending write operation exists, the internal state flag is not properly cleared, preventing the device from sending data when reopened. This can cause Bluetooth devices to become unresponsive after being disabled and re-enabled, affecting connectivity and user experience.
Technical details
The vulnerability is a race condition in the HCI UART driver (drivers/bluetooth/hci_ldisc.c) involving improper state management of the HCI_UART_SENDING flag. The write_work state flag is not cleared when canceling pending work in hci_uart_close(), blocking future write operations if write_work was pending at close time. The fix involves using disable_work_sync() + enable_work() instead of cancel_work_sync() for safe tx_skb handling, and moving work cancellation to hci_uart_flush() where the proto TX queue is also purged. The HCI_UART_SENDING bit is then explicitly cleared, with TX wakeup potentially requeuing work after flush. Attack vector requires local access to trigger device reopen sequences; no network or authentication bypass is involved.
Affected products
- Linux Linux kernel Multiple versions (see kernel.org stable branches)
Timeline
- 2026-08-10: disclosed
- 2026-06-13: patched: Fix commit 1b0d946d6f08bd39211385bc703a440911b41e46 authored