The Linux kernel Bluetooth hci_uart driver had a flaw where the HCI_UART_SENDING bit in the tx_state was not cleared when canceling the write_work in hci_uart_close(). This bit indicates a pending write_work and prevents queueing new writes. Because it was not cleared, reopening the device after canceling a pending write blocked future writes. The patch clears this bit when canceling the work and modifies the clearing of the transmit buffer to use disable_work_sync and enable_work instead of cancel_work_sync alone. This ensures proper flushing and re-queuing of work after the transmit queue is purged.

The issue could cause blocked write operations to the Bluetooth device after reopening it if a write was pending and canceled. This may lead to malfunction or denial of service of Bluetooth communication on affected systems. No known exploits in the wild have been reported.

A fix has been applied to the Linux kernel to clear the HCI_UART_SENDING bit when canceling write_work and to safely clear the transmit buffer. Users should update to a Linux kernel version that includes this patch. Patch status is not explicitly confirmed in the provided data; check the vendor or Linux kernel advisories for the exact fixed versions and update accordingly.