---
id: CVE-2026-98297
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained

  hci_send_acl(), hci_send_sco() and hci_send_iso() queue hdev->tx_work
  unconditionally
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained

  hci_send_acl(), hci_send_sco() and hci_send_iso() queue hdev->tx_work
  unconditionally. They can run…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 9cebe4680bb9a72f80c6541eb24af06db7a1fbc9 <
    ab0678a0701ac4de499428dc1b321659bb74d272
  - >-
    Linux >= 47330cc875b36a1cf7b3543cb2cf90a7c603ce0e <
    e220c1242a643d97102a79f09b7ef3aa31276961
  - >-
    Linux >= 525daaea459fc215f432de1b8debbd9144bf97b0 <
    cbb325bc150e8c0dbce004ac0e5516bcffc0de31
  - >-
    Linux >= 525daaea459fc215f432de1b8debbd9144bf97b0 <
    6610c6fe4b8936c232048e6049bf77c70a6f759c
  - Linux 60bceb9a4c693e68cc90ba4b2dfb9e000e8638ff
  - Linux >= 6.12.93 < 6.12.112
  - Linux >= 6.18.35 < 6.18.54
  - Linux >= 7.0.12 < 7.1
  - Linux 7.1
published: '2026-10-06'
updated: '2026-10-06'
sourceUpdated: '2026-10-06T09:18:20.400'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-98297'
references:
  - url: 'https://git.kernel.org/stable/c/6610c6fe4b8936c232048e6049bf77c70a6f759c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/ab0678a0701ac4de499428dc1b321659bb74d272'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/cbb325bc150e8c0dbce004ac0e5516bcffc0de31'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e220c1242a643d97102a79f09b7ef3aa31276961'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-10-06T08:50:17.414Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained

hci_send_acl(), hci_send_sco() and hci_send_iso() queue hdev->tx_work
unconditionally. They can run from the L2CAP/SCO/ISO socket send path
while hci_dev_close_sync() is draining hdev->workqueue (HCIDEVDOWN
racing with a socket write). Since that queue_work() is not chained
work from the tx_work worker itself, __queue_work() sees the queue
marked __WQ_DRAINING, warns "cannot queue %ps on wq %s", and drops
the work:

  WARNING: CPU: 1 PID: 5985 at kernel/workqueue.c:2352 __queue_work
  Call Trace:
   queue_work_on
   l2cap_chan_send
   l2cap_sock_sendmsg
   ...

hci_dev_close_sync() already sets HCI_CMD_DRAIN_WORKQUEUE before
draining, but only hci_cmd_work() and handle_cmd_cnt_and_timer()
check it before queuing. Route the tx_work producers through the
same guard via a shared hci_sched_tx() helper.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.