CVE-2026-98809Bluetooth: hci_sync: don't drain cmd_sync backlog on unregister
- —Not scoredno CVSS score yet
- 0.17%Exploitation in 30 daysEPSS · top 93% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: don't drain cmd_sync backlog on unregister hci_unregister_dev() disables cmd_work and cmd_timer, then calls hci_cmd_sync_clear(), whose cancel_work_sync() waits for hci_cmd_sync_work() to return. That worker dequeues and runs every entry on cmd_sync_work_list. With cmd_work disabled nothing reaches the controller, so each queued HCI command waits the full HCI_CMD_TIMEOUT (2s). The backlog has no bound. Userspace can keep queuing MGMT commands such as MGMT_OP_GET_CLOCK_INFO against a controller that doesn't answer. Closing /dev/vhci then blocks in vhci_release() for backlog * 2s: INFO: task syz-executor:5749 blocked for more than 143 seconds. cancel_work_sync hci_cmd_sync_clear hci_unregister_dev vhci_release In a local reproduction the backlog held more than 5000 entries, which comes to hours of hang. Stop the worker from taking new entries once HCI_UNREGISTER is set, and wake any request still waiting with -ENODEV before cancelling the work. The entries left over are destroyed with -ECANCELED by the existing sweep in hci_cmd_sync_clear(). They stay on the list until the work has stopped, so hci_cmd_sync_dequeue() and friends still see them. A callback already running may still issue another command, which delays unregister by at most one timeout per remaining command, not by the whole backlog.
Timeline
ID reserved
By Linux
- 23 days later
· 23 days later
Published
- 12 days later
· 12 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
No CVSS score yet: neither the CNA, CISA nor NVD has scored this CVE. NVD status: Received.
- EPSS (exploitation in 30 days)
- 0.17% · top 93% of all CVEs (12 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Not scored.
Affected products
- affected 008ee9eb8a11bcabf12c91771dd4f470b082bd44 – < b06d85b114cc5fa61809f9950bca66502e0e1173
- affected 008ee9eb8a11bcabf12c91771dd4f470b082bd44 – < b11acfcb5925ed27fae692b27931a1ac732677fb
- affected 008ee9eb8a11bcabf12c91771dd4f470b082bd44 – < 143bde97c4101ae68eb656c87e620c45b07a3090
- affected 008ee9eb8a11bcabf12c91771dd4f470b082bd44 – < 7f16443a30f4e86d84ae4faf057d333b41ddb757
- affected 008ee9eb8a11bcabf12c91771dd4f470b082bd44 – < e8ba8c9c74d1035042cdf6cb5adf8f59b9b1271c
- affected 008ee9eb8a11bcabf12c91771dd4f470b082bd44 – < b1f24c1ab52345e810c42a1a81286cb5a7c92252
- affected 5.17
- unaffected < 5.17
- unaffected 6.1.191 – ≤ 6.1.*
- unaffected 6.6.160 – ≤ 6.6.*
- unaffected 6.12.113 – ≤ 6.12.*
- unaffected 6.18.56 – ≤ 6.18.*
- unaffected 7.2.10 – ≤ 7.2.*
- unaffected 7.3 – ≤ *
References
References6
- https://git.kernel.org/stable/c/b06d85b114cc5fa61809f9950bca66502e0e1173 (opens in a new tab)
- https://git.kernel.org/stable/c/b11acfcb5925ed27fae692b27931a1ac732677fb (opens in a new tab)
- https://git.kernel.org/stable/c/143bde97c4101ae68eb656c87e620c45b07a3090 (opens in a new tab)
- https://git.kernel.org/stable/c/7f16443a30f4e86d84ae4faf057d333b41ddb757 (opens in a new tab)
- https://git.kernel.org/stable/c/e8ba8c9c74d1035042cdf6cb5adf8f59b9b1271c (opens in a new tab)
- https://git.kernel.org/stable/c/b1f24c1ab52345e810c42a1a81286cb5a7c92252 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-103894 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-98809)Record last updated .