CVE-2026-98109 (GCVE-0-2026-98109)
Vulnerability from cvelistv5
Published
2026-09-25 10:35
Modified
2026-10-19 09:14
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Fix race condition during device registration In hci_register_dev(), the power_on work item is queued to hdev->req_workqueue before initializing hdev->adv_monitors_idr and registering the MSFT extension via msft_register(). For devices marked with quirks such as HCI_QUIRK_RAW_DEVICE, the HCI_UNCONFIGURED flag is set on the device. When the power_on work item runs concurrently on another CPU, hci_power_on() detects that the device is unconfigured and immediately invokes hci_dev_do_close(), which calls msft_do_close(). Concurrently, msft_register() allocates the msft structure and exposes it to hdev->msft_data prior to calling mutex_init(&msft->filter_lock). If msft_do_close() executes while hdev->msft_data is already assigned but the mutex has not yet been initialized, mutex_lock(&msft->filter_lock) operates on an uninitialized mutex, triggering a DEBUG_LOCKS warning: DEBUG_LOCKS_WARN_ON(lock->magic != lock) WARNING: kernel/locking/mutex.c:625 at __mutex_lock_common kernel/locking/mutex.c:625 [inline] WARNING: kernel/locking/mutex.c:625 at __mutex_lock+0x12d8/0x1550 kernel/locking/mutex.c:821 ... Call Trace: <TASK> msft_do_close+0x308/0x7b0 net/bluetooth/msft.c:693 hci_dev_close_sync+0x86b/0x10a0 net/bluetooth/hci_sync.c:5522 hci_dev_do_close net/bluetooth/hci_core.c:499 [inline] hci_power_on+0x32c/0x750 net/bluetooth/hci_core.c:937 process_one_work kernel/workqueue.c:3322 [inline] process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405 worker_thread+0x92d/0xe10 kernel/workqueue.c:3486 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK> Fix this by moving the queue_work() call in hci_register_dev() to after idr_init(&hdev->adv_monitors_idr) and msft_register(hdev) so that device structures and extensions are fully initialized before asynchronous tasks can access them. Additionally, assign hdev->msft_data in msft_register() only after mutex_init(&msft->filter_lock) has completed.
References
Impacted products
Vendor Product Version
Linux Linux Version: 9e14606d8f38ea52a38c27692a9c1513c987a5da
Version: 9e14606d8f38ea52a38c27692a9c1513c987a5da
Version: 9e14606d8f38ea52a38c27692a9c1513c987a5da
Version: 9e14606d8f38ea52a38c27692a9c1513c987a5da
Version: 9e14606d8f38ea52a38c27692a9c1513c987a5da
Version: f9965f7f38c90449a5fb26edb8a7d22b1dcf0283
Version: 80fe27811c56ecd3896c3d511ab8298146071d98
Version: 6.4.16   ≤
Version: 6.5.3   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_core.c",
            "net/bluetooth/msft.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "593e64f64a20b25e4042c3ee863119eb7f991785",
              "status": "affected",
              "version": "9e14606d8f38ea52a38c27692a9c1513c987a5da",
              "versionType": "git"
            },
            {
              "lessThan": "b1faf348c29e6f8302ec7769cbf1c1ef05be014f",
              "status": "affected",
              "version": "9e14606d8f38ea52a38c27692a9c1513c987a5da",
              "versionType": "git"
            },
            {
              "lessThan": "a11ebe8dc0333fb870bbbb656b34690e87ee3f98",
              "status": "affected",
              "version": "9e14606d8f38ea52a38c27692a9c1513c987a5da",
              "versionType": "git"
            },
            {
              "lessThan": "d427b1c71d9798083e954d3c13469dc0a2305868",
              "status": "affected",
              "version": "9e14606d8f38ea52a38c27692a9c1513c987a5da",
              "versionType": "git"
            },
            {
              "lessThan": "57938bbdb9bf7fd41cbd5cd509ec10c4b22bec18",
              "status": "affected",
              "version": "9e14606d8f38ea52a38c27692a9c1513c987a5da",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f9965f7f38c90449a5fb26edb8a7d22b1dcf0283",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "80fe27811c56ecd3896c3d511ab8298146071d98",
              "versionType": "git"
            },
            {
              "lessThan": "6.5",
              "status": "affected",
              "version": "6.4.16",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6",
              "status": "affected",
              "version": "6.5.3",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_core.c",
            "net/bluetooth/msft.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "lessThan": "6.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.158",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.7",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.5.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_core: Fix race condition during device registration\n\nIn hci_register_dev(), the power_on work item is queued to\nhdev-\u003ereq_workqueue before initializing hdev-\u003eadv_monitors_idr and\nregistering the MSFT extension via msft_register(). For devices marked with\nquirks such as HCI_QUIRK_RAW_DEVICE, the HCI_UNCONFIGURED flag is set on\nthe device. When the power_on work item runs concurrently on another CPU,\nhci_power_on() detects that the device is unconfigured and immediately\ninvokes hci_dev_do_close(), which calls msft_do_close().\n\nConcurrently, msft_register() allocates the msft structure and exposes it\nto hdev-\u003emsft_data prior to calling mutex_init(\u0026msft-\u003efilter_lock). If\nmsft_do_close() executes while hdev-\u003emsft_data is already assigned but the\nmutex has not yet been initialized, mutex_lock(\u0026msft-\u003efilter_lock) operates\non an uninitialized mutex, triggering a DEBUG_LOCKS warning:\n\nDEBUG_LOCKS_WARN_ON(lock-\u003emagic != lock)\nWARNING: kernel/locking/mutex.c:625 at __mutex_lock_common\nkernel/locking/mutex.c:625 [inline]\nWARNING: kernel/locking/mutex.c:625 at __mutex_lock+0x12d8/0x1550\nkernel/locking/mutex.c:821\n...\nCall Trace:\n \u003cTASK\u003e\n msft_do_close+0x308/0x7b0 net/bluetooth/msft.c:693\n hci_dev_close_sync+0x86b/0x10a0 net/bluetooth/hci_sync.c:5522\n hci_dev_do_close net/bluetooth/hci_core.c:499 [inline]\n hci_power_on+0x32c/0x750 net/bluetooth/hci_core.c:937\n process_one_work kernel/workqueue.c:3322 [inline]\n process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405\n worker_thread+0x92d/0xe10 kernel/workqueue.c:3486\n kthread+0x388/0x470 kernel/kthread.c:436\n ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n \u003c/TASK\u003e\n\nFix this by moving the queue_work() call in hci_register_dev() to after\nidr_init(\u0026hdev-\u003eadv_monitors_idr) and msft_register(hdev) so that device\nstructures and extensions are fully initialized before asynchronous tasks\ncan access them. Additionally, assign hdev-\u003emsft_data in msft_register()\nonly after mutex_init(\u0026msft-\u003efilter_lock) has completed."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T09:14:01.739Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/593e64f64a20b25e4042c3ee863119eb7f991785"
        },
        {
          "url": "https://git.kernel.org/stable/c/b1faf348c29e6f8302ec7769cbf1c1ef05be014f"
        },
        {
          "url": "https://git.kernel.org/stable/c/a11ebe8dc0333fb870bbbb656b34690e87ee3f98"
        },
        {
          "url": "https://git.kernel.org/stable/c/d427b1c71d9798083e954d3c13469dc0a2305868"
        },
        {
          "url": "https://git.kernel.org/stable/c/57938bbdb9bf7fd41cbd5cd509ec10c4b22bec18"
        }
      ],
      "title": "Bluetooth: hci_core: Fix race condition during device registration",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98109",
    "datePublished": "2026-09-25T10:35:57.537Z",
    "dateReserved": "2026-09-25T10:25:14.316Z",
    "dateUpdated": "2026-10-19T09:14:01.739Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.