CVE-2026-98297

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained

hci_send_acl(), hci_send_sco() and hci_send_iso() queue hdev->tx_work

unconditionally. They can run from the L2CAP/SCO/ISO socket send path

while hci_dev_close_sync() is draining hdev->workqueue (HCIDEVDOWN

racing with a socket write). Since that queue_work() is not chained

work from the tx_work worker itself, __queue_work() sees the queue

marked __WQ_DRAINING, warns "cannot queue %ps on wq %s", and drops

the work:

WARNING: CPU: 1 PID: 5985 at kernel/workqueue.c:2352 __queue_work

Call Trace:

queue_work_on

l2cap_chan_send

l2cap_sock_sendmsg

...

hci_dev_close_sync() already sets HCI_CMD_DRAIN_WORKQUEUE before

draining, but only hci_cmd_work() and handle_cmd_cnt_and_timer()

check it before queuing. Route the tx_work producers through the

same guard via a shared hci_sched_tx() helper.