CVE-2026-98809 - Vulnerability Details

- Bluetooth: hci_sync: don't drain cmd_sync backlog on unregister

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_sync: don't drain cmd_sync backlog on unregister

hci_unregister_dev() disables cmd_work and cmd_timer, then calls
hci_cmd_sync_clear(), whose cancel_work_sync() waits for
hci_cmd_sync_work() to return. That worker dequeues and runs every
entry on cmd_sync_work_list. With cmd_work disabled nothing reaches
the controller, so each queued HCI command waits the full
HCI_CMD_TIMEOUT (2s).

The backlog has no bound. Userspace can keep queuing MGMT commands
such as MGMT_OP_GET_CLOCK_INFO against a controller that doesn't
answer. Closing /dev/vhci then blocks in vhci_release() for
backlog * 2s:

INFO: task syz-executor:5749 blocked for more than 143 seconds.
cancel_work_sync
hci_cmd_sync_clear
hci_unregister_dev
vhci_release

In a local reproduction the backlog held more than 5000 entries,
which comes to hours of hang.

Stop the worker from taking new entries once HCI_UNREGISTER is set,
and wake any request still waiting with -ENODEV before cancelling
the work. The entries left over are destroyed with -ECANCELED by the
existing sweep in hci_cmd_sync_clear(). They stay on the list until
the work has stopped, so hci_cmd_sync_dequeue() and friends still see
them. A callback already running may still issue another command,
which delays unregister by at most one timeout per remaining command,
not by the whole backlog.

Published: 2026-10-18

Score: 4.4 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

When a Bluetooth virtual host controller interface device is unregistered, the kernel fails to drain the pending command backlog. The worker is disabled but the queued HCI commands still remain in a list; each command times out after the 2‑second HCI_CMD_TIMEOUT. Because the backlog is unbounded, userspace can enqueue thousands of management operations against a silent controller, making the unregistration routine wait for each timeout. In a local test more than 5,000 pending commands caused the process to block for more than 143 seconds, and with a larger backlog the pause can grow to hours. The result is a denial of service that blocks the device release routine and can freeze userland interactions with the Bluetooth interface. The underlying weakness is uncontrolled resource exhaustion due to an unbounded queue that is not drained when the device is taken offline.

Affected Systems

All Linux kernel versions that contain the hci_sync code prior to the commit that introduces the backlog drain. The issue affects the core Bluetooth stack of the Linux kernel and is relevant to any installation that uses the virtual host controller interface (VHCI) or generic Bluetooth functionality.

Risk and Exploitability

The CVSS score is 4.4, indicating moderate severity, and the EPSS score remains under 1%. The vulnerability is listed as not in the CISA KEV catalog, indicating no publicly known exploitation yet. The likely attack vector is local: any user with the ability to enqueue Bluetooth management commands can trigger the backlog by repeatedly issuing operations such as MGMT_OP_GET_CLOCK_INFO against a non‑responsive controller. Because the backlog grows without bound, an attacker can cause the system to hang for extended periods, effectively derailing services that rely on Bluetooth or the kernel's ability to cleanly unregister the device. While no true remote exploitation path is described, the severity of the denial of service and potential for causing a system freeze make it a high‑risk issue for systems that expose Bluetooth interfaces to untrusted users or applications.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`008ee9eb8a11bcabf12c91771dd4f470b082bd44`	affected	< b06d85b114cc5fa61809f9950bca66502e0e1173
`008ee9eb8a11bcabf12c91771dd4f470b082bd44`	affected	< b11acfcb5925ed27fae692b27931a1ac732677fb
`008ee9eb8a11bcabf12c91771dd4f470b082bd44`	affected	< 143bde97c4101ae68eb656c87e620c45b07a3090
`008ee9eb8a11bcabf12c91771dd4f470b082bd44`	affected	< 7f16443a30f4e86d84ae4faf057d333b41ddb757
`008ee9eb8a11bcabf12c91771dd4f470b082bd44`	affected	< e8ba8c9c74d1035042cdf6cb5adf8f59b9b1271c
`008ee9eb8a11bcabf12c91771dd4f470b082bd44`	affected	< b1f24c1ab52345e810c42a1a81286cb5a7c92252

Linux

affected

Version	Status	Constraints
`5.17`	affected	—
`0`	unaffected	< 5.17
`6.1.191`	unaffected	≤ 6.1.*
`6.6.160`	unaffected	≤ 6.6.*
`6.12.113`	unaffected	≤ 6.12.*
`6.18.56`	unaffected	≤ 6.18.*
`7.2.10`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[008ee9eb8a11bcabf12c91771dd4f470b082bd44,143bde97c4101ae68eb656c87e620c45b07a3090)`	affected	code_commit	—
`[008ee9eb8a11bcabf12c91771dd4f470b082bd44,7f16443a30f4e86d84ae4faf057d333b41ddb757)`	affected	code_commit	—
`[008ee9eb8a11bcabf12c91771dd4f470b082bd44,e8ba8c9c74d1035042cdf6cb5adf8f59b9b1271c)`	affected	code_commit	—
`[008ee9eb8a11bcabf12c91771dd4f470b082bd44,b1f24c1ab52345e810c42a1a81286cb5a7c92252)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.17`	affected	generic	—
`[0,5.17)`	unaffected	semver	—
`[6.12.113,7.0.0)`	unaffected	semver	—
`[6.18.56,7.0.0)`	unaffected	semver	—
`[7.2.10,8.0.0)`	unaffected	semver	—
`[7.3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the Linux kernel to a patched version that implements backlog draining during device unregister
If a kernel update is not immediately possible, disable or remove any unused Bluetooth virtual host controller interfaces to prevent command queuing
Configure or monitor the Bluetooth subsystem so that any unregistration operation is timed out or restarted automatically if it blocks for an extended period

Generated by OpenCVE AI on October 24, 2026 at 01:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4850-1	linux-6.12 security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00173.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98809.mbox
https://git.kernel.org/stable/c/143bde97c4101ae68eb656c87e620c45b07a3090
https://git.kernel.org/stable/c/7f16443a30f4e86d84ae4faf057d333b41ddb757
https://git.kernel.org/stable/c/b06d85b114cc5fa61809f9950bca66502e0e1173
https://git.kernel.org/stable/c/b11acfcb5925ed27fae692b27931a1ac732677fb
https://git.kernel.org/stable/c/b1f24c1ab52345e810c42a1a81286cb5a7c92252
https://git.kernel.org/stable/c/e8ba8c9c74d1035042cdf6cb5adf8f59b9b1271c
https://nvd.nist.gov/vuln/detail/CVE-2026-98809
https://www.cve.org/CVERecord?id=CVE-2026-98809

History

Fri, 30 Oct 2026 13:00:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/b06d85b114cc5fa61809f9950bca66502e0e1173

Sat, 24 Oct 2026 00:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98809.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98809 https://www.cve.org/CVERecord?id=CVE-2026-98809
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Wed, 21 Oct 2026 13:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/b11acfcb5925ed27fae692b27931a1ac732677fb

Sun, 18 Oct 2026 20:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-770

Sun, 18 Oct 2026 16:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: don't drain cmd_sync backlog on unregister hci_unregister_dev() disables cmd_work and cmd_timer, then calls hci_cmd_sync_clear(), whose cancel_work_sync() waits for hci_cmd_sync_work() to return. That worker dequeues and runs every entry on cmd_sync_work_list. With cmd_work disabled nothing reaches the controller, so each queued HCI command waits the full HCI_CMD_TIMEOUT (2s). The backlog has no bound. Userspace can keep queuing MGMT commands such as MGMT_OP_GET_CLOCK_INFO against a controller that doesn't answer. Closing /dev/vhci then blocks in vhci_release() for backlog * 2s: INFO: task syz-executor:5749 blocked for more than 143 seconds. cancel_work_sync hci_cmd_sync_clear hci_unregister_dev vhci_release In a local reproduction the backlog held more than 5000 entries, which comes to hours of hang. Stop the worker from taking new entries once HCI_UNREGISTER is set, and wake any request still waiting with -ENODEV before cancelling the work. The entries left over are destroyed with -ECANCELED by the existing sweep in hci_cmd_sync_clear(). They stay on the list until the work has stopped, so hci_cmd_sync_dequeue() and friends still see them. A callback already running may still issue another command, which delays unregister by at most one timeout per remaining command, not by the whole backlog.
Title		Bluetooth: hci_sync: don't drain cmd_sync backlog on unregister
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/143bde97c4101ae68eb656c87e620c45b07a3090 https://git.kernel.org/stable/c/7f16443a30f4e86d84ae4faf057d333b41ddb757 https://git.kernel.org/stable/c/b1f24c1ab52345e810c42a1a81286cb5a7c92252 https://git.kernel.org/stable/c/e8ba8c9c74d1035042cdf6cb5adf8f59b9b1271c

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-18T15:48:55.913Z

Updated: 2026-10-30T12:39:55.898Z

Reserved: 2026-09-25T10:25:14.371Z

Link: CVE-2026-98809

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-18T16:17:34.997

Modified: 2026-10-30T13:21:28.643

Link: CVE-2026-98809

Redhat

Severity : Moderate

Publid Date: 2026-10-18T00:00:00Z

Links: CVE-2026-98809 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-24T01:45:17Z

Weaknesses

CWE-770
Allocation of Resources Without Limits or Throttling

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object