CVE-2026-68085: Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hciuart: clear HCIUARTSENDING when writework is canceled
HCIUARTSENDING bit in txstate means writework is pending and blocks queueing it again. Currently this bit is not cleared when canceling the work in hciuartclose(), which blocks future writes when device is reopened later if writework was pending.
Fix by clearing HCIUARTSENDING when canceling the work.
Also make clearing of txskb safe by using disableworksync + enablework instead of just cancelworksync. hciuartflush() purges the proto tx queue so we can cancel the pending writework there, instead of doing it just in hciuartclose(). Re-enable and possibly requeue the work after queue flush.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68085?
CVE-2026-68085 has a risk rating of 17, indicating a significant vulnerability within the Linux kernel affecting Bluetooth functionality.
How do I fix CVE-2026-68085?
To fix CVE-2026-68085, update your Linux kernel to the latest patched version that addresses this Bluetooth issue.
What systems are affected by CVE-2026-68085?
CVE-2026-68085 affects systems running vulnerable versions of the Linux kernel that utilize Bluetooth capabilities.
What type of vulnerability is CVE-2026-68085?
CVE-2026-68085 is a programming error in the Linux kernel's Bluetooth implementation related to the handling of HCI_UART state.
Is there a workaround for CVE-2026-68085?
Currently, there is no official workaround for CVE-2026-68085 other than applying the recommended kernel update.