CVE-2026-98297

A flaw was found in the Linux kernel's Bluetooth subsystem. A race condition occurs when network transmission requests are queued while the Bluetooth device is being shut down and its background workqueue is draining. A local attacker could exploit this vulnerability by sending data through Bluetooth sockets during device closure, leading to kernel warnings, dropped operations, and a potential Denial of Service (DoS).

A low impact race condition was found in the Linux kernel's Bluetooth subsystem. The hci_send_acl(), hci_send_sco(), and hci_send_iso() functions queue hdev->tx_work unconditionally, so a local user who writes to L2CAP/SCO/ISO Bluetooth sockets while the device is being closed (HCIDEVDOWN racing with a socket write while hci_dev_close_sync() drains hdev->workqueue) can trigger a kernel WARNING in __queue_work() and cause the pending transmission work to be dropped. The demonstrated consequence is limited availability degradation of the Bluetooth connection being torn down, with no memory corruption, information disclosure, or privilege escalation; Red Hat therefore rates the impact as Low even though the CVSS 3.1 base score is 5.5 (Moderate). This flaw affects the kernel in Red Hat Enterprise Linux 9 (rhel-9.9, rhel-9.10) and Red Hat Enterprise Linux 10 (rhel-10.3, rhel-10.4), and the kernel and kernel-ivos-qualcomm components in Red Hat In-Vehicle OS 2, because the change that introduced the vulnerable device-close workqueue-draining path was backported to those streams. Red Hat Enterprise Linux 7 and 8, the earlier RHEL 9 (9.2 through 9.8) and RHEL 10 (10.0, 10.2) kernel streams, the kernel-rt packages, and the OpenShift Container Platform RHCOS images do not contain that introducing change and are therefore not affected. Fixes for the affected streams are currently deferred given the low impact of the issue; the residual risk is limited to a local user with Bluetooth socket access disrupting the teardown of a Bluetooth device, which requires winning a narrow timing window during device closure and does not affect confidentiality, integrity, or system stability beyond dropped Bluetooth transmission work.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.