{"id":"CVE-2026-98809","kind":"vulnerability","aliases":["CVE-2026-98809"],"related":[],"title":"Linux kernel: Bluetooth unregister can hang for hours on command backlog","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: don't drain cmd_sync backlog on unregister\n\nhci_unregister_dev() disables cmd_work and cmd_timer, then calls\nhci_cmd_sync_clear(), whose cancel_work_sync() waits for\nhci_cmd_sync_work() to return. That worker dequeues and runs every\nentry on cmd_sync_work_list. With cmd_work disabled nothing reaches\nthe controller, so each queued HCI command waits the full\nHCI_CMD_TIMEOUT (2s).\n\nThe backlog has no bound. Userspace can keep queuing MGMT commands\nsuch as MGMT_OP_GET_CLOCK_INFO against a controller that doesn't\nanswer. Closing /dev/vhci then blocks in vhci_release() for\nbacklog * 2s:\n\n  INFO: task syz-executor:5749 blocked for more than 143 seconds.\n   cancel_work_sync\n   hci_cmd_sync_clear\n   hci_unregister_dev\n   vhci_release\n\nIn a local reproduction the backlog held more than 5000 entries,\nwhich comes to hours of hang.\n\nStop the worker from taking new entries once HCI_UNREGISTER is set,\nand wake any request still waiting with -ENODEV before cancelling\nthe work. The entries left over are destroyed with -ECANCELED by the\nexisting sweep in hci_cmd_sync_clear(). They stay on the list until\nthe work has stopped, so hci_cmd_sync_dequeue() and friends still see\nthem. A callback already running may still issue another command,\nwhich delays unregister by at most one timeout per remaining command,\nnot by the whole backlog.","summary":"A local user can queue many Bluetooth management commands to a controller that never replies, then closing the vhci device stalls the kernel thread for hours. The sources describe a denial of service, not code execution.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bluetooth","linux-kernel","other","self-hosted"],"not_affected_if":["no-bluetooth-hardware","vhci-not-loaded"],"how_to_check":"- Run `uname -r` and compare with the fixed kernel versions in the advisory (unknown from sources)\n- Check whether the vhci_hci driver is loaded with `lsmod | grep hci_vhci`","fix":"- Update the Linux kernel to a release that includes the upstream commit 'Bluetooth: hci_sync: don't drain cmd_sync backlog on unregister' (fixed versions unknown from sources)","status":"open","published_at":"2026-10-18T16:17:34+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:14:59+00:00","updated_at":"2026-10-25T05:14:59+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T05:14:59Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit 'Bluetooth: hci_sync: don't drain cmd_sync backlog on unregister' (fixed versions unknown from sources)","reach":"local","title":"Linux kernel: Bluetooth unregister can hang for hours on command backlog","impact":"low","summary":"A local user can queue many Bluetooth management commands to a controller that never replies, then closing the vhci device stalls the kernel thread for hours. The sources describe a denial of service, not code execution.","category":"other","nicknames":[],"who_cares":["linux-kernel","bluetooth","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"local users hang kernel tasks for hours, causing denial of service","analyst_note":"","how_to_check":"- Run `uname -r` and compare with the fixed kernel versions in the advisory (unknown from sources)\n- Check whether the vhci_hci driver is loaded with `lsmod | grep hci_vhci`","needs_analyst":false,"not_affected_if":["no-bluetooth-hardware","vhci-not-loaded"],"who_is_affected":"Systems running a Linux kernel with Bluetooth support where a local user can open /dev/vhci or otherwise drive HCI management commands. Servers and hosts without Bluetooth hardware or the vhci driver are unlikely to be exposed. Users who cannot open the device can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000649,"input_tokens":3796,"output_tokens":539,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-98809':14A,17A '/dev/vhci':168C '143':187C '2s':141C,176C '5000':210C '5749':182C 'alreadi':281C 'anoth':286C 'answer':166C 'backlog':11A,80C,143C,175C,206C,303C 'block':170C,183C 'bluetooth':3A,18B,32B,72C 'bound':146C 'call':93C 'callback':280C 'cancel':99C,189C,239C 'clear':97C,195C,258C 'clock':158C 'close':42B,167C 'cmd':78C,87C,90C,95C,105C,118C,123C,139C,193C,256C,271C 'code':60B 'come':213C 'command':10A,34B,134C,152C,287C,298C 'control':37B,129C,162C 'cve':12A,15A 'delay':289C 'denial':56B 'dequeu':112C,273C 'describ':54B 'destroy':247C 'dev':85C,198C 'devic':45B 'disabl':86C,125C 'doesn':164C 'drain':77C 'ecancel':249C 'enodev':237C 'entri':116C,211C,224C,243C 'everi':115C 'execut':61B 'executor':181C 'exist':252C 'follow':67C 'friend':275C 'full':137C 'get':157C 'hang':6A,217C 'hci':73C,83C,94C,104C,133C,138C,192C,196C,226C,255C,270C 'held':207C 'host':25B 'hour':8A,51B,215C 'info':159C,177C 'issu':285C 'keep':149C 'kernel':2A,21B,48B,65C 'left':244C 'linux':1A,20B,64C 'linux-kernel':19B 'list':121C,263C 'local':27B,203C 'manag':33B 'mani':31B 'may':283C 'mgmt':151C,155C 'never':39B 'new':223C 'noth':126C 'one':294C 'op':156C 'per':296C 'queu':132C,150C 'queue':30B 'reach':127C 'releas':173C,200C 'remain':297C 'repli':40B 'reproduct':204C 'request':233C 'resolv':71C 'return':109C 'run':114C,282C 'second':188C 'see':277C 'self':24B 'self-host':23B 'servic':58B 'set':229C 'sourc':53B 'stall':46B 'stay':260C 'still':234C,276C,284C 'stop':218C,268C 'sweep':253C 'sync':74C,79C,96C,101C,106C,119C,191C,194C,257C,272C 'syz':180C 'syz-executor':179C 'take':222C 'task':178C 'thread':49B 'timeout':140C,295C 'timer':91C 'unregist':4A,82C,84C,197C,227C,290C 'user':28B 'userspac':147C 'vhci':44B,172C,199C 'vulner':68C 'wait':102C,135C,235C 'wake':231C 'whole':302C 'whose':98C 'work':88C,100C,107C,120C,124C,190C,241C,266C 'worker':111C,220C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with Bluetooth support where a local user can open /dev/vhci or otherwise drive HCI management commands. Servers and hosts without Bluetooth hardware or the vhci driver are unlikely to be exposed. Users who cannot open the device can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:34+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98809","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98809","severity":null,"published_at":"2026-10-18T16:17:34+00:00","modified_at":"2026-10-21T13:21:47+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}