CVE-2026-68085

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-68085
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68085.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-68085
Downstream
AZL (1)
BELL (1)
DEBIAN (1)
openSUSE (1)
SUSE (10)
UBUNTU (1)
Related
openSUSE (1)
SUSE (10)
Published
2026-08-10T11:51:39Z
Modified
2026-10-08T02:51:37Z
Severity
  • 8.0 (High) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled
Details

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled

HCI_UART_SENDING bit in tx_state means write_work is pending and blocks queueing it again. Currently this bit is not cleared when canceling the work in hci_uart_close(), which blocks future writes when device is reopened later if write_work was pending.

Fix by clearing HCI_UART_SENDING when canceling the work.

Also make clearing of tx_skb safe by using disable_work_sync + enable_work instead of just cancel_work_sync. hci_uart_flush() purges the proto tx queue so we can cancel the pending write_work there, instead of doing it just in hci_uart_close(). Re-enable and possibly requeue the work after queue flush.

Database specific 
{
    "cna_assigner":  "Linux",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68085.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
81c7a3c22a0f2808cf4ae0b4908f59763b23606d
Fixed
d52446b3e735cfdbdc2a58342163803bc2e64249
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
192cb0f1ca706d9a1bc36ae0ad5f666d1e4fd894
Fixed
b9dd39cf1667e378b25a082ca796d495d578c5d3
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
c1bb9336ae6b54a5f6a353c4bd4ed9a4307e429b
Fixed
714d861d35d937f23375a4517569b13917bbbe51
Fixed
1b0d946d6f08bd39211385bc703a440911b41e46
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
6.12.92
Fixed
6.12.96
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
6.18.34
Fixed
6.18.39
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
5.10.258
Fixed
5.11
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
5.15.209
Fixed
5.16
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
6.1.175
Fixed
6.2
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
6.6.142
Fixed
6.7
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
7.0.11
Fixed
7.1
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
78aad93e938f013d9272fe0ee168f27883afa95c
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
e2d19969c8d9198ecc3090bcd5312ecd503a3339
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
c85cff648a2bc92322912db5f1727ad05afae7b6
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
9d20d48be2c4a071fb015eb09bda2cecd25daf34
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
7338031946bd06f6dff149e67b60c4cd083bfea8

Affected versions

v5.*
v5.10.258
v5.10.259
v5.10.260
v5.10.261
v5.10.262
v5.10.263
v5.10.264
v5.10.265
v5.10.266
v5.10.267
v5.10.268
v5.10.269
v5.10.270
v5.10.271
v5.15.209
v5.15.210
v5.15.211
v5.15.212
v5.15.213
v5.15.214
v5.15.215
v5.15.216
v5.15.217
v5.15.218
v5.15.219
v5.15.220
v5.15.221
v5.15.222
v6.*
v6.1.175
v6.1.176
v6.1.177
v6.1.178
v6.1.179
v6.1.180
v6.1.181
v6.1.182
v6.1.183
v6.1.184
v6.1.185
v6.1.186
v6.1.187
v6.1.188
v6.1.189
v6.12.92
v6.12.93
v6.12.94
v6.12.95
v6.18.34
v6.18.35
v6.18.36
v6.18.37
v6.18.38
v6.6.142
v6.6.143
v6.6.144
v6.6.145
v6.6.146
v6.6.147
v6.6.148
v6.6.149
v6.6.150
v6.6.151
v6.6.152
v6.6.153
v6.6.154
v6.6.155
v6.6.156
v6.6.157
v6.6.158
v7.*
v7.0.11
v7.0.12
v7.0.13
v7.0.14

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68085.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
6.12.96
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.39
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.1.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68085.json"