CVE-2026-98109: Bluetooth: hci_core: Fix race condition during device registration
Bluetooth: hcicore: Fix race condition during device registration
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.158 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.111 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.53 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.7 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.116-1Fixed in 7.2.15-1Fixed in 7.3.3-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.115-2~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In hci_register_dev(), move the queue_work() call until after idr_init(&hdev->adv_monitors_idr) and msft_register(hdev) have completed. In msft_register(), assign hdev->msft_data only after mutex_init(&msft->filter_lock) completes, ensuring device structures and the MSFT extension are fully initialized before asynchronous work can access them.
Event History
Frequently Asked Questions
Which Bluetooth devices are exposed to this race?
The described race applies to devices marked with quirks such as HCI_QUIRK_RAW_DEVICE, which causes the HCI_UNCONFIGURED flag to be set. The vulnerable path occurs during registration when power-on work can run concurrently with MSFT extension registration.
What timing is required to trigger the issue?
The power_on work item must run on another CPU while device registration is still initializing the MSFT data. The failure occurs if the close path reaches msft_do_close() after hdev->msft_data is exposed but before msft->filter_lock has been initialized.
How can an affected system be identified?
A triggered race can produce a DEBUG_LOCKS warning when mutex_lock() operates on the uninitialized filter_lock. The reported warning includes DEBUG_LOCKS_WARN_ON(lock->magic != lock) and points to kernel/locking/mutex.c in __mutex_lock_common or __mutex_lock.