# CVE-2026-98809: Bluetooth: hci_sync: don't drain cmd_sync backlog on unregister

> A local attacker can cause a denial of service in the Linux kernel by exhausting the Bluetooth HCI command backlog, leading to system hangs during device unregistration.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Any signed-in user
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 18 Oct 2026
- **Updated:** 21 Oct 2026
- **Also known as:** AZL-108714, BELL-CVE-2026-98809, DEBIAN-CVE-2026-98809, GHSA-h4f7-ppg7-73c7, UBUNTU-CVE-2026-98809

## What is CVE-2026-98809?

CVE-2026-98809 is a denial of service vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_sync: don't drain cmd_sync backlog on unregister

hci_unregister_dev() disables cmd_work and cmd_timer, then calls
hci_cmd_sync_clear(), whose cancel_work_sync() waits for
hci_cmd_sync_work() to return. That worker dequeues and runs every
entry on cmd_sync_work_list. With cmd_work disabled nothing reaches
the controller, so each queued HCI command waits the full
HCI_CMD_TIMEOUT (2s).

The backlog has no bound. Userspace can keep queuing MGMT commands
such as MGMT_OP_GET_CLOCK_INFO against a controller that doesn't
answer. Closing /dev/vhci then blocks in vhci_release() for
backlog * 2s:

  INFO: task syz-executor:5749 blocked for more than 143 seconds.
   cancel_work_sync
   hci_cmd_sync_clear
   hci_unregister_dev
   vhci_release

In a local reproduction the backlog held more than 5000 entries,
which comes to hours of hang.

Stop the worker from taking new entries once HCI_UNREGISTER is set,
and wake any request still waiting with -ENODEV before cancelling
the work. The entries left over are destroyed with -ECANCELED by the
existing sweep in hci_cmd_sync_clear(). They stay on the list until
the work has stopped, so hci_cmd_sync_dequeue() and friends still see
them. A callback already running may still issue another command,
which delays unregister by at most one timeout per remaining command,
not by the whole backlog.

## Which versions are affected by CVE-2026-98809?


## How do I fix CVE-2026-98809?

Apply the vendor's patch.

## Is CVE-2026-98809 being exploited?

There is no known exploitation of CVE-2026-98809 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-98809 and fix it if it is affected.

What it is: CVE-2026-98809 is a denial of service vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-98809 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-98809/ (Markdown: https://insights.sbomify.com/CVE-2026-98809/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-98809
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-98809
- OSV: https://osv.dev/vulnerability/CVE-2026-98809

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-98809/
Summaries are generated and may contain mistakes; the official description above is the record.