---
id: CVE-2026-68085
title: 'Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled

  HCI_UART_SENDING bit in tx_state means write_work is pending and blocks
  queueing it again.  Cur…
severity: high
cvss: 8
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 81c7a3c22a0f2808cf4ae0b4908f59763b23606d <
    d52446b3e735cfdbdc2a58342163803bc2e64249
  - >-
    Linux >= 192cb0f1ca706d9a1bc36ae0ad5f666d1e4fd894 <
    b9dd39cf1667e378b25a082ca796d495d578c5d3
  - >-
    Linux >= c1bb9336ae6b54a5f6a353c4bd4ed9a4307e429b <
    714d861d35d937f23375a4517569b13917bbbe51
  - >-
    Linux >= c1bb9336ae6b54a5f6a353c4bd4ed9a4307e429b <
    1b0d946d6f08bd39211385bc703a440911b41e46
  - Linux 78aad93e938f013d9272fe0ee168f27883afa95c
  - Linux e2d19969c8d9198ecc3090bcd5312ecd503a3339
  - Linux c85cff648a2bc92322912db5f1727ad05afae7b6
  - Linux 9d20d48be2c4a071fb015eb09bda2cecd25daf34
  - Linux 7338031946bd06f6dff149e67b60c4cd083bfea8
  - Linux >= 6.12.92 < 6.12.96
  - Linux >= 6.18.34 < 6.18.39
  - Linux >= 5.10.258 < 5.11
  - Linux >= 5.15.209 < 5.16
  - Linux >= 6.1.175 < 6.2
  - Linux >= 6.6.142 < 6.7
  - Linux >= 7.0.11 < 7.1
  - Linux 7.1
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:43:36.224665Z'
published: '2026-08-10'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:52:55.858Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-68085'
references:
  - url: 'https://git.kernel.org/stable/c/d52446b3e735cfdbdc2a58342163803bc2e64249'
  - url: 'https://git.kernel.org/stable/c/b9dd39cf1667e378b25a082ca796d495d578c5d3'
  - url: 'https://git.kernel.org/stable/c/714d861d35d937f23375a4517569b13917bbbe51'
  - url: 'https://git.kernel.org/stable/c/1b0d946d6f08bd39211385bc703a440911b41e46'
tags:
  - cve.org
epss: 0.00251
epssPercentile: 0.15363
ingestedAt: '2026-10-16T17:24:46.838Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled

HCI_UART_SENDING bit in tx_state means write_work is pending and blocks
queueing it again.  Currently this bit is not cleared when canceling the
work in hci_uart_close(), which blocks future writes when device is
reopened later if write_work was pending.

Fix by clearing HCI_UART_SENDING when canceling the work.

Also make clearing of tx_skb safe by using disable_work_sync +
enable_work instead of just cancel_work_sync.  hci_uart_flush() purges
the proto tx queue so we can cancel the pending write_work there,
instead of doing it just in hci_uart_close().  Re-enable and possibly
requeue the work after queue flush.

## Affected

- `Linux >= 81c7a3c22a0f2808cf4ae0b4908f59763b23606d < d52446b3e735cfdbdc2a58342163803bc2e64249`
- `Linux >= 192cb0f1ca706d9a1bc36ae0ad5f666d1e4fd894 < b9dd39cf1667e378b25a082ca796d495d578c5d3`
- `Linux >= c1bb9336ae6b54a5f6a353c4bd4ed9a4307e429b < 714d861d35d937f23375a4517569b13917bbbe51`
- `Linux >= c1bb9336ae6b54a5f6a353c4bd4ed9a4307e429b < 1b0d946d6f08bd39211385bc703a440911b41e46`
- `Linux 78aad93e938f013d9272fe0ee168f27883afa95c`
- `Linux e2d19969c8d9198ecc3090bcd5312ecd503a3339`
- `Linux c85cff648a2bc92322912db5f1727ad05afae7b6`
- `Linux 9d20d48be2c4a071fb015eb09bda2cecd25daf34`
- `Linux 7338031946bd06f6dff149e67b60c4cd083bfea8`
- `Linux >= 6.12.92 < 6.12.96`
- `Linux >= 6.18.34 < 6.18.39`
- `Linux >= 5.10.258 < 5.11`
- `Linux >= 5.15.209 < 5.16`
- `Linux >= 6.1.175 < 6.2`
- `Linux >= 6.6.142 < 6.7`
- `Linux >= 7.0.11 < 7.1`
- `Linux 7.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.