In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hciuart: clear HCIUARTSENDING when writework is canceled
HCIUARTSENDING bit in txstate means writework is pending and blocks queueing it again. Currently this bit is not cleared when canceling the work in hciuartclose(), which blocks future writes when device is reopened later if write_work was pending.
Fix by clearing HCIUARTSENDING when canceling the work.
Also make clearing of txskb safe by using disableworksync + enablework instead of just cancelworksync. hciuartflush() purges the proto tx queue so we can cancel the pending writework there, instead of doing it just in hciuart_close(). Re-enable and possibly requeue the work after queue flush.