CVE-2026-98809

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci sync: don't drain cmd sync backlog on unregister

hci unregister dev() disables cmd work and cmd timer, then calls hci cmd sync clear(), whose cancel work sync() waits for hci cmd sync work() to return. That worker dequeues and runs every entry on cmd sync work list. With cmd work disabled nothing reaches the controller, so each queued HCI command waits the full HCI CMD TIMEOUT (2s).

The backlog has no bound. Userspace can keep queuing MGMT commands such as MGMT OP GET CLOCK INFO against a controller that doesn't answer. Closing /dev/vhci then blocks in vhci release() for backlog * 2s:

INFO: task syz-executor:5749 blocked for more than 143 seconds. cancel work sync hci cmd sync clear hci unregister dev vhci release

In a local reproduction the backlog held more than 5000 entries, which comes to hours of hang.

Stop the worker from taking new entries once HCI UNREGISTER is set, and wake any request still waiting with -ENODEV before cancelling the work. The entries left over are destroyed with -ECANCELED by the existing sweep in hci cmd sync clear(). They stay on the list until the work has stopped, so hci cmd sync dequeue() and friends still see them. A callback already running may still issue another command, which delays unregister by at most one timeout per remaining command, not by the whole backlog.