CVE-2026-98109

A flaw was found in the Linux kernel's Bluetooth subsystem. A race condition occurs during device registration when background initialization tasks execute before internal structures and locks are fully prepared. A local user can trigger this issue during device setup, causing the system to attempt locking an uninitialized resource. This flaw can lead to a Denial of Service (DoS) resulting from a kernel crash or system instability.

A moderate impact flaw was found in the Linux kernel Bluetooth subsystem as shipped in Red Hat Enterprise Linux 9 and 10, RHIVOS 2.0 and 2.1, and Red Hat OpenShift 4.16 and later versions built on RHEL 9 CoreOS. During Bluetooth controller registration in hci_register_dev(), the power_on work item can be queued before internal data structures, including the Microsoft (MSFT) vendor extension data and its filter_lock mutex, are fully initialized. On devices marked with quirks such as HCI_QUIRK_RAW_DEVICE, a concurrently running hci_power_on() detects that the device is unconfigured and closes it, causing msft_do_close() to attempt to lock the not-yet-initialized mutex. This triggers a kernel lock debugging warning and can crash the kernel. A local user who can trigger Bluetooth device setup can win this race condition and cause a denial of service; confidentiality and integrity are not affected. Red Hat rates this flaw Moderate with a CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), while NIST assigns 4.7 (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H); both are Moderate and differ only in the assessed attack complexity. Earlier product versions, including RHEL 7, RHEL 8, earlier RHEL 9 minor streams, and OpenShift 4.15 and earlier, are not affected because the vulnerable code is not present in those kernels. Fixes for the affected streams are deferred to a future planned kernel update; the residual risk is considered low because successful exploitation requires local access with the ability to trigger Bluetooth device registration, must win a narrow initialization race window, and at worst results in a system crash or instability rather than any confidentiality or integrity impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.