{"id":"CVE-2026-68085","title":"Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled\n\nHCI_UART_SENDING bit in tx_state means write_work is pending and blocks\nqueueing it again.  Cur…","severity":"high","cvss":8,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 81c7a3c22a0f2808cf4ae0b4908f59763b23606d < d52446b3e735cfdbdc2a58342163803bc2e64249","Linux >= 192cb0f1ca706d9a1bc36ae0ad5f666d1e4fd894 < b9dd39cf1667e378b25a082ca796d495d578c5d3","Linux >= c1bb9336ae6b54a5f6a353c4bd4ed9a4307e429b < 714d861d35d937f23375a4517569b13917bbbe51","Linux >= c1bb9336ae6b54a5f6a353c4bd4ed9a4307e429b < 1b0d946d6f08bd39211385bc703a440911b41e46","Linux 78aad93e938f013d9272fe0ee168f27883afa95c","Linux e2d19969c8d9198ecc3090bcd5312ecd503a3339","Linux c85cff648a2bc92322912db5f1727ad05afae7b6","Linux 9d20d48be2c4a071fb015eb09bda2cecd25daf34","Linux 7338031946bd06f6dff149e67b60c4cd083bfea8","Linux >= 6.12.92 < 6.12.96","Linux >= 6.18.34 < 6.18.39","Linux >= 5.10.258 < 5.11","Linux >= 5.15.209 < 5.16","Linux >= 6.1.175 < 6.2","Linux >= 6.6.142 < 6.7","Linux >= 7.0.11 < 7.1","Linux 7.1"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T15:43:36.224665Z"},"published":"2026-08-10","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:52:55.858Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-68085","references":[{"url":"https://git.kernel.org/stable/c/d52446b3e735cfdbdc2a58342163803bc2e64249"},{"url":"https://git.kernel.org/stable/c/b9dd39cf1667e378b25a082ca796d495d578c5d3"},{"url":"https://git.kernel.org/stable/c/714d861d35d937f23375a4517569b13917bbbe51"},{"url":"https://git.kernel.org/stable/c/1b0d946d6f08bd39211385bc703a440911b41e46"}],"tags":["cve.org"],"epss":0.00251,"epssPercentile":0.15363,"ingestedAt":"2026-10-16T17:24:46.838Z","slug":"CVE-2026-68085","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled\n\nHCI_UART_SENDING bit in tx_state means write_work is pending and blocks\nqueueing it again.  Currently this bit is not cleared when canceling the\nwork in hci_uart_close(), which blocks future writes when device is\nreopened later if write_work was pending.\n\nFix by clearing HCI_UART_SENDING when canceling the work.\n\nAlso make clearing of tx_skb safe by using disable_work_sync +\nenable_work instead of just cancel_work_sync.  hci_uart_flush() purges\nthe proto tx queue so we can cancel the pending write_work there,\ninstead of doing it just in hci_uart_close().  Re-enable and possibly\nrequeue the work after queue flush.\n\n## Affected\n\n- `Linux >= 81c7a3c22a0f2808cf4ae0b4908f59763b23606d < d52446b3e735cfdbdc2a58342163803bc2e64249`\n- `Linux >= 192cb0f1ca706d9a1bc36ae0ad5f666d1e4fd894 < b9dd39cf1667e378b25a082ca796d495d578c5d3`\n- `Linux >= c1bb9336ae6b54a5f6a353c4bd4ed9a4307e429b < 714d861d35d937f23375a4517569b13917bbbe51`\n- `Linux >= c1bb9336ae6b54a5f6a353c4bd4ed9a4307e429b < 1b0d946d6f08bd39211385bc703a440911b41e46`\n- `Linux 78aad93e938f013d9272fe0ee168f27883afa95c`\n- `Linux e2d19969c8d9198ecc3090bcd5312ecd503a3339`\n- `Linux c85cff648a2bc92322912db5f1727ad05afae7b6`\n- `Linux 9d20d48be2c4a071fb015eb09bda2cecd25daf34`\n- `Linux 7338031946bd06f6dff149e67b60c4cd083bfea8`\n- `Linux >= 6.12.92 < 6.12.96`\n- `Linux >= 6.18.34 < 6.18.39`\n- `Linux >= 5.10.258 < 5.11`\n- `Linux >= 5.15.209 < 5.16`\n- `Linux >= 6.1.175 < 6.2`\n- `Linux >= 6.6.142 < 6.7`\n- `Linux >= 7.0.11 < 7.1`\n- `Linux 7.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":44,"depthScoreParts":{"impact":44,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}