---
id: CVE-2026-98297
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained

  hci_send_acl(), hci_send_sco() and hci_send_iso() queue hdev->tx_work
  unconditionally
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained

  hci_send_acl(), hci_send_sco() and hci_send_iso() queue hdev->tx_work
  unconditionally. They can run…
severity: medium
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 9cebe4680bb9a72f80c6541eb24af06db7a1fbc9 <
    ab0678a0701ac4de499428dc1b321659bb74d272
  - >-
    Linux >= 47330cc875b36a1cf7b3543cb2cf90a7c603ce0e <
    e220c1242a643d97102a79f09b7ef3aa31276961
  - >-
    Linux >= 525daaea459fc215f432de1b8debbd9144bf97b0 <
    cbb325bc150e8c0dbce004ac0e5516bcffc0de31
  - >-
    Linux >= 525daaea459fc215f432de1b8debbd9144bf97b0 <
    6610c6fe4b8936c232048e6049bf77c70a6f759c
  - Linux 60bceb9a4c693e68cc90ba4b2dfb9e000e8638ff
  - Linux >= 6.12.93 < 6.12.112
  - Linux >= 6.18.35 < 6.18.54
  - Linux >= 7.0.12 < 7.1
  - Linux 7.1
published: '2026-10-06'
updated: '2026-10-06'
sourceUpdated: '2026-10-06T09:18:20.400'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-98297'
references:
  - url: 'https://git.kernel.org/stable/c/6610c6fe4b8936c232048e6049bf77c70a6f759c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/ab0678a0701ac4de499428dc1b321659bb74d272'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/cbb325bc150e8c0dbce004ac0e5516bcffc0de31'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e220c1242a643d97102a79f09b7ef3aa31276961'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98297.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-98297'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2546449'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-98297'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-98297'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98297.mbox
  - url: 'https://git.kernel.org/stable/c/8010212197d4a3ee714f78ed77048d0b712ff925'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
ingestedAt: '2026-10-06T08:50:17.414Z'
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe:
  - CWE-366
epss: 0.00175
epssPercentile: 0.06995
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained

hci_send_acl(), hci_send_sco() and hci_send_iso() queue hdev->tx_work
unconditionally. They can run from the L2CAP/SCO/ISO socket send path
while hci_dev_close_sync() is draining hdev->workqueue (HCIDEVDOWN
racing with a socket write). Since that queue_work() is not chained
work from the tx_work worker itself, __queue_work() sees the queue
marked __WQ_DRAINING, warns "cannot queue %ps on wq %s", and drops
the work:

  WARNING: CPU: 1 PID: 5985 at kernel/workqueue.c:2352 __queue_work
  Call Trace:
   queue_work_on
   l2cap_chan_send
   l2cap_sock_sendmsg
   ...

hci_dev_close_sync() already sets HCI_CMD_DRAIN_WORKQUEUE before
draining, but only hci_cmd_work() and handle_cmd_cnt_and_timer()
check it before queuing. Route the tx_work producers through the
same guard via a shared hci_sched_tx() helper.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Low · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · updated 2026-10-18 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98297.json)