CVE-2026-98809: Linux Kernel Bluetooth HCI DoS Vulnerability

CVE-2026-98809 Overview

CVE-2026-98809 is a denial-of-service vulnerability in the Linux kernel Bluetooth subsystem. The flaw resides in the hci_sync command handling path, where hci_unregister_dev() can block for extended periods while draining a queue of pending HCI commands. Each queued command waits the full HCI_CMD_TIMEOUT of two seconds because cmd_work has already been disabled before the backlog is processed. Local userspace can abuse this by queuing Management (MGMT) commands such as MGMT_OP_GET_CLOCK_INFO against an unresponsive controller, then closing /dev/vhci. The backlog has no upper bound, and a reproducer accumulated more than 5000 entries, translating to hours of kernel hang.

Critical Impact
Local attackers can hang the kernel task performing Bluetooth controller unregister for hours, resulting in a resource-exhaustion denial-of-service condition against the host.

Affected Products

Linux kernel Bluetooth subsystem (net/bluetooth/hci_sync.c)
Virtual HCI driver exposing /dev/vhci
Distributions shipping kernels prior to the fixes referenced in the stable commits

Discovery Timeline

2026-10-18 - CVE-2026-98809 published to NVD
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-98809

Vulnerability Analysis

The defect lives in the Bluetooth hci_sync command synchronization logic. When hci_unregister_dev() tears down a controller, it first disables cmd_work and cmd_timer, then calls hci_cmd_sync_clear(). That function invokes cancel_work_sync(), which waits for the currently running hci_cmd_sync_work() to finish. The worker continues dequeuing and executing every entry on cmd_sync_work_list even though cmd_work is already disabled. Because no command can reach the controller, each queued request waits the full HCI_CMD_TIMEOUT of two seconds before being discarded. The list has no bound, so a sufficient number of entries extends the unregister path from seconds to hours.

Root Cause

The root cause is a missing guard against the HCI_UNREGISTER state inside hci_cmd_sync_work(). The worker treats the queue identically during normal operation and during teardown, and pending callers are not woken with an error status before cancellation. This produces an unbounded serialized wait inside the kernel task that invoked the release path, for example vhci_release().

Attack Vector

A local user with access to /dev/vhci or an equivalent HCI transport can submit a large volume of MGMT commands such as MGMT_OP_GET_CLOCK_INFO to a controller that will never respond. Closing the file descriptor triggers vhci_release(), which calls into hci_unregister_dev() and blocks the calling task for backlog * 2s. The observed syslog signature shows a task blocked in cancel_work_sync → hci_cmd_sync_clear → hci_unregister_dev → vhci_release. Exploitation requires local access and does not yield code execution, but it can be used to stall container teardown, device hotplug, or system shutdown. The upstream fix stops the worker from accepting new entries once HCI_UNREGISTER is set and wakes pending requests with -ENODEV before cancellation; remaining entries are swept with -ECANCELED.

Detection Methods for CVE-2026-98809

Indicators of Compromise

Kernel log entries reporting INFO: task ... blocked for more than N seconds with a stack trace including cancel_work_sync, hci_cmd_sync_clear, hci_unregister_dev, and vhci_release.
Processes stuck in uninterruptible sleep (D state) that hold open handles to /dev/vhci or Bluetooth MGMT sockets.
Sudden growth in queued HCI commands on cmd_sync_work_list observed via kernel debugging interfaces.

Detection Strategies

Monitor dmesg and journal output for hung_task warnings referencing Bluetooth unregister paths.
Track userspace processes issuing high volumes of MGMT ioctls to Bluetooth HCI devices, particularly MGMT_OP_GET_CLOCK_INFO.
Alert on vhci_release or hci_unregister_dev entries appearing in soft-lockup or RCU stall reports.

Monitoring Recommendations

Collect kernel task state and hung-task telemetry from Linux endpoints and forward it to a centralized logging pipeline for correlation.
Baseline normal Bluetooth MGMT command rates per host and flag unusual spikes from unprivileged processes.
Audit which local accounts and containers have access to /dev/vhci and Bluetooth capabilities, and alert on new grants.

How to Mitigate CVE-2026-98809

Immediate Actions Required

Apply the stable kernel updates that include the upstream fix for hci_sync unregister handling.
Restrict access to /dev/vhci and Bluetooth MGMT sockets to trusted administrators only.
Review container and sandbox profiles to ensure untrusted workloads cannot open virtual HCI devices.

Patch Information

The fix stops hci_cmd_sync_work() from accepting new entries once HCI_UNREGISTER is set, wakes any waiting request with -ENODEV, and relies on the existing sweep in hci_cmd_sync_clear() to destroy remaining entries with -ECANCELED. The change is distributed across the following stable commits: Linux Kernel Commit 143bde9, Linux Kernel Commit 7f16443, Linux Kernel Commit b11acfcb, Linux Kernel Commit b1f24c1a, and Linux Kernel Commit e8ba8c9c.

Workarounds

Disable or blacklist the vhci kernel module on systems that do not require virtual Bluetooth controllers.
Remove CAP_NET_ADMIN and Bluetooth device access from untrusted users, services, and container runtimes.
Unload the Bluetooth stack entirely (rmmod bluetooth) on servers where Bluetooth is not needed.

bash

# Configuration example: blacklist the virtual HCI module and reload initramfs
echo 'blacklist vhci' | sudo tee /etc/modprobe.d/blacklist-vhci.conf
sudo update-initramfs -u
sudo reboot