In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: don't drain cmd_sync backlog on unregister… (CVE-2026-98809)

The vulnerability in the Linux kernel Bluetooth hci_sync component involved improper handling of the cmd_sync backlog during device unregistering. Specifically, hci_unregister_dev disables command processing but then waits for the command worker to finish, which processes all queued commands. Since command processing is disabled, queued commands wait for the full HCI_CMD_TIMEOUT (2 seconds) each, and the backlog can grow without bound if userspace continues queuing commands against an unresponsive controller. This leads to very long blocking times in vhci_release when closing virtual HCI devices, as demonstrated by a backlog exceeding 5000 entries causing hangs of hours. The fix stops the worker from taking new commands once unregistering starts and wakes waiting requests with an error before cancelling the work, ensuring timely cleanup and preventing excessive blocking.

Local userspace processes interacting with Bluetooth virtual HCI devices could experience very long blocking times or hangs when closing devices due to unbounded synchronous command backlogs. This can degrade system responsiveness and potentially cause denial of service conditions locally. There is no indication of remote exploitation or privilege escalation from the provided data.

A fix has been implemented in the Linux kernel to address this issue by modifying the hci_sync backlog handling during device unregistering. Users should update to a Linux kernel version that includes this fix once available. Until then, avoiding excessive queuing of synchronous Bluetooth commands against unresponsive controllers may reduce the risk of hangs. Patch status is not explicitly confirmed in the provided data; check the vendor or kernel advisory for current remediation guidance.