CVE-2026-98297 Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained
A race condition in the Linux kernel Bluetooth subsystem can cause a kernel warning and drop work, leading to a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98297?
CVE-2026-98297 is a vulnerability in Linux, published on 6 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained
hci_send_acl(), hci_send_sco() and hci_send_iso() queue hdev->tx_work unconditionally. They can run from the L2CAP/SCO/ISO socket send path while hci_dev_close_sync() is draining hdev->workqueue (HCIDEVDOWN racing with a socket write). Since that queue_work() is not chained work from the tx_work worker itself, __queue_work() sees the queue marked __WQ_DRAINING, warns "cannot queue %ps on wq %s", and drops the work:
WARNING: CPU: 1 PID: 5985 at kernel/workqueue.c:2352 __queue_work Call Trace: queue_work_on l2cap_chan_send l2cap_sock_sendmsg ...
hci_dev_close_sync() already sets HCI_CMD_DRAIN_WORKQUEUE before draining, but only hci_cmd_work() and handle_cmd_cnt_and_timer() check it before queuing. Route the tx_work producers through the same guard via a shared hci_sched_tx() helper.
Which versions are affected by CVE-2026-98297?
How do I fix CVE-2026-98297?
Apply the vendor's patch.
Is CVE-2026-98297 being exploited?
There is no known exploitation of CVE-2026-98297 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-98297, DEBIAN-CVE-2026-98297, GHSA-mvfp-xjr6-rmvq, UBUNTU-CVE-2026-98297.