CVE-2026-68085

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the Bluetooth hci uart component where the HCI UART SENDING bit in tx state is not cleared when write work is canceled within the hci uart close() function. This bit indicates that write work is pending and prevents it from being queued again. Consequently, if write work was pending when the device was closed, future write operations are blocked when the device is reopened. The fix involves clearing the HCI UART SENDING bit during work cancellation and ensuring the clearing of tx skb is safe by replacing cancel work sync with a combination of disable work sync and enable work. Additionally, the pending write work is now canceled in hci uart flush() to purge the proto tx queue, with the work being re-enabled and potentially requeued after the flush.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.