CVE-2026-68085

A flaw was found in the Linux kernel's Bluetooth Host Controller Interface (HCI) Universal Asynchronous Receiver/Transmitter (UART) driver. This vulnerability occurs when a Bluetooth device is reopened after a pending write operation was canceled, but an internal flag indicating a pending write is not properly cleared. A local attacker could exploit this to prevent future write operations to the device, leading to a denial of service where Bluetooth functionality for write tasks becomes unresponsive.

Bluetooth hci_uart can leave HCI_UART_SENDING set when pending write_work is canceled during close, which can block future TX after the device is reopened. The same path also clears tx_skb during flush while write_work may otherwise be active, making this a race and possible use-after-free candidate around the UART TX state. For the CVSS the PR:L is used for the paranoid score because a local user or service with access to Bluetooth HCI UART control or the backing tty may be able to trigger close reopen or flush paths without full host administrator privileges. The issue is not directly network reachable and requires local interaction with the Bluetooth UART control path. Impact is at least local denial of service through a stuck TX path or kernel crash, and in the worst case may allow confidentiality or integrity impact if the tx_skb race is exploitable as memory corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.