CVE-2026-98297
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained hci_send_acl(), hci_send_sco() and hci_send_iso() queue hdev->tx_work unconditionally. They can run from the L2CAP/SCO/ISO socket send path while hci_dev_close_sync() is draining hdev->workqueue (HCIDEVDOWN racing with a socket write). Since that queue_work() is not chained work from the tx_work worker itself, __queue_work() sees the queue marked __WQ_DRAINING, warns "cannot queue %ps on wq %s", and drops the work: WARNING: CPU: 1 PID: 5985 at kernel/workqueue.c:2352 __queue_work Call Trace: queue_work_on l2cap_chan_send l2cap_sock_sendmsg ... hci_dev_close_sync() already sets HCI_CMD_DRAIN_WORKQUEUE before draining, but only hci_cmd_work() and handle_cmd_cnt_and_timer() check it before queuing. Route the tx_work producers through the same guard via a shared hci_sched_tx() helper.
Affected versions
Linux kernel versions
6.12.93,
6.18.35,
7.0.12,
7.1
and later are affected. Fixed in
6.12.112,
6.18.54,
7.2.8,
7.3-rc4
and their respective stable series.
References
4 totalFrequently asked questions
-
What is CVE-2026-98297?
CVE-2026-98297 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 6.12.93 onward and has been patched in 6.12.112, 6.18.54, 7.2.8 and others. CVE-2026-98297 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-98297?
Yes. CVE-2026-98297 has been patched. Fixed versions include 6.12.112, 6.18.54, 7.2.8 and others. If you are running Linux kernel 6.12.93 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-98297 actively exploited?
No. CVE-2026-98297 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.