GHSA-H4F7-PPG7-73C7
Vulnerability from github – Published: 2026-10-18 18:32 – Updated: 2026-10-30 15:34In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_sync: don't drain cmd_sync backlog on unregister
hci_unregister_dev() disables cmd_work and cmd_timer, then calls hci_cmd_sync_clear(), whose cancel_work_sync() waits for hci_cmd_sync_work() to return. That worker dequeues and runs every entry on cmd_sync_work_list. With cmd_work disabled nothing reaches the controller, so each queued HCI command waits the full HCI_CMD_TIMEOUT (2s).
The backlog has no bound. Userspace can keep queuing MGMT commands such as MGMT_OP_GET_CLOCK_INFO against a controller that doesn't answer. Closing /dev/vhci then blocks in vhci_release() for backlog * 2s:
INFO: task syz-executor:5749 blocked for more than 143 seconds. cancel_work_sync hci_cmd_sync_clear hci_unregister_dev vhci_release
In a local reproduction the backlog held more than 5000 entries, which comes to hours of hang.
Stop the worker from taking new entries once HCI_UNREGISTER is set, and wake any request still waiting with -ENODEV before cancelling the work. The entries left over are destroyed with -ECANCELED by the existing sweep in hci_cmd_sync_clear(). They stay on the list until the work has stopped, so hci_cmd_sync_dequeue() and friends still see them. A callback already running may still issue another command, which delays unregister by at most one timeout per remaining command, not by the whole backlog.
{
"affected": [],
"aliases": [
"CVE-2026-98809"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-18T16:17:34Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: don\u0027t drain cmd_sync backlog on unregister\n\nhci_unregister_dev() disables cmd_work and cmd_timer, then calls\nhci_cmd_sync_clear(), whose cancel_work_sync() waits for\nhci_cmd_sync_work() to return. That worker dequeues and runs every\nentry on cmd_sync_work_list. With cmd_work disabled nothing reaches\nthe controller, so each queued HCI command waits the full\nHCI_CMD_TIMEOUT (2s).\n\nThe backlog has no bound. Userspace can keep queuing MGMT commands\nsuch as MGMT_OP_GET_CLOCK_INFO against a controller that doesn\u0027t\nanswer. Closing /dev/vhci then blocks in vhci_release() for\nbacklog * 2s:\n\n INFO: task syz-executor:5749 blocked for more than 143 seconds.\n cancel_work_sync\n hci_cmd_sync_clear\n hci_unregister_dev\n vhci_release\n\nIn a local reproduction the backlog held more than 5000 entries,\nwhich comes to hours of hang.\n\nStop the worker from taking new entries once HCI_UNREGISTER is set,\nand wake any request still waiting with -ENODEV before cancelling\nthe work. The entries left over are destroyed with -ECANCELED by the\nexisting sweep in hci_cmd_sync_clear(). They stay on the list until\nthe work has stopped, so hci_cmd_sync_dequeue() and friends still see\nthem. A callback already running may still issue another command,\nwhich delays unregister by at most one timeout per remaining command,\nnot by the whole backlog.",
"id": "GHSA-h4f7-ppg7-73c7",
"modified": "2026-10-30T15:34:04Z",
"published": "2026-10-18T18:32:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98809"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/143bde97c4101ae68eb656c87e620c45b07a3090"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/7f16443a30f4e86d84ae4faf057d333b41ddb757"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b06d85b114cc5fa61809f9950bca66502e0e1173"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b11acfcb5925ed27fae692b27931a1ac732677fb"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b1f24c1ab52345e810c42a1a81286cb5a7c92252"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e8ba8c9c74d1035042cdf6cb5adf8f59b9b1271c"
}
],
"schema_version": "1.4.0",
"severity": []
}
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.