CVE-2026-98109: Bluetooth: hci_core: Fix race condition during device registration
Bluetooth: hcicore: Fix race condition during device registration
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In hci_register_dev(), initialize hdev->adv_monitors_idr with idr_init() and complete msft_register() initialization—including mutex_init(&msft->filter_lock)—before assigning hdev->msft_data and before queueing the power_on work item; move the queue_work() call to after these initializations.
Event History
Frequently Asked Questions
Which Bluetooth devices are exposed to this race?
The described race applies to devices marked with quirks such as HCI_QUIRK_RAW_DEVICE, which causes the HCI_UNCONFIGURED flag to be set. The vulnerable path occurs during registration when power-on work can run concurrently with MSFT extension registration.
What timing is required to trigger the issue?
The power_on work item must run on another CPU while device registration is still initializing the MSFT data. The failure occurs if the close path reaches msft_do_close() after hdev->msft_data is exposed but before msft->filter_lock has been initialized.
How can an affected system be identified?
A triggered race can produce a DEBUG_LOCKS warning when mutex_lock() operates on the uninitialized filter_lock. The reported warning includes DEBUG_LOCKS_WARN_ON(lock->magic != lock) and points to kernel/locking/mutex.c in __mutex_lock_common or __mutex_lock.