{"id":"CVE-2026-68085","summary":"Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled\n\nHCI_UART_SENDING bit in tx_state means write_work is pending and blocks\nqueueing it again.  Currently this bit is not cleared when canceling the\nwork in hci_uart_close(), which blocks future writes when device is\nreopened later if write_work was pending.\n\nFix by clearing HCI_UART_SENDING when canceling the work.\n\nAlso make clearing of tx_skb safe by using disable_work_sync +\nenable_work instead of just cancel_work_sync.  hci_uart_flush() purges\nthe proto tx queue so we can cancel the pending write_work there,\ninstead of doing it just in hci_uart_close().  Re-enable and possibly\nrequeue the work after queue flush.","modified":"2026-10-28T02:30:51.281656695Z","published":"2026-08-10T11:51:39.079Z","related":["SUSE-SU-2026:23477-1","SUSE-SU-2026:23481-1","SUSE-SU-2026:23528-1","SUSE-SU-2026:23529-1","SUSE-SU-2026:23881-1","SUSE-SU-2026:23887-1","SUSE-SU-2026:23897-1","SUSE-SU-2026:23902-1","SUSE-SU-2026:4120-1","SUSE-SU-2026:4254-1","openSUSE-SU-2026:21910-1"],"database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68085.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/1b0d946d6f08bd39211385bc703a440911b41e46"},{"type":"WEB","url":"https://git.kernel.org/stable/c/714d861d35d937f23375a4517569b13917bbbe51"},{"type":"WEB","url":"https://git.kernel.org/stable/c/b9dd39cf1667e378b25a082ca796d495d578c5d3"},{"type":"WEB","url":"https://git.kernel.org/stable/c/d52446b3e735cfdbdc2a58342163803bc2e64249"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68085.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68085"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"81c7a3c22a0f2808cf4ae0b4908f59763b23606d"},{"fixed":"d52446b3e735cfdbdc2a58342163803bc2e64249"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"192cb0f1ca706d9a1bc36ae0ad5f666d1e4fd894"},{"fixed":"b9dd39cf1667e378b25a082ca796d495d578c5d3"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"c1bb9336ae6b54a5f6a353c4bd4ed9a4307e429b"},{"fixed":"714d861d35d937f23375a4517569b13917bbbe51"},{"fixed":"1b0d946d6f08bd39211385bc703a440911b41e46"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"6.12.92"},{"fixed":"6.12.96"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"6.18.34"},{"fixed":"6.18.39"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"5.10.258"},{"fixed":"5.11"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"5.15.209"},{"fixed":"5.16"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"6.1.175"},{"fixed":"6.2"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"6.6.142"},{"fixed":"6.7"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"7.0.11"},{"fixed":"7.1"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"78aad93e938f013d9272fe0ee168f27883afa95c"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"e2d19969c8d9198ecc3090bcd5312ecd503a3339"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"c85cff648a2bc92322912db5f1727ad05afae7b6"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"9d20d48be2c4a071fb015eb09bda2cecd25daf34"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"7338031946bd06f6dff149e67b60c4cd083bfea8"}]}],"versions":["v6.12.95","v6.12.94","v6.12.93","v6.12.92","v6.18.38","v6.18.37","v6.18.36","v6.18.35","v6.18.34","v5.10.272","v5.10.271","v5.10.270","v5.10.269","v5.10.268","v5.10.267","v5.10.266","v5.10.265","v5.10.264","v5.10.263","v5.10.262","v5.10.261","v5.10.260","v5.10.259","v5.10.258","v5.15.223","v5.15.222","v5.15.221","v5.15.220","v5.15.219","v5.15.218","v5.15.217","v5.15.216","v5.15.215","v5.15.214","v5.15.213","v5.15.212","v5.15.211","v5.15.210","v5.15.209","v6.1.190","v6.1.189","v6.1.188","v6.1.187","v6.1.186","v6.1.185","v6.1.184","v6.1.183","v6.1.182","v6.1.181","v6.1.180","v6.1.179","v6.1.178","v6.1.177","v6.1.176","v6.1.175","v6.6.160","v6.6.159","v6.6.158","v6.6.157","v6.6.156","v6.6.155","v6.6.154","v6.6.153","v6.6.152","v6.6.151","v6.6.150","v6.6.149","v6.6.148","v6.6.147","v6.6.146","v6.6.145","v6.6.144","v6.6.143","v6.6.142","v7.0.14","v7.0.13","v7.0.12","v7.0.11"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68085.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.96"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.39"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.1.4"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68085.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}