The Linux kernel Bluetooth hci_uart subsystem had a flaw where the HCI_UART_SENDING bit in tx_state, which indicates a pending write_work, was not cleared when the write_work was canceled in hci_uart_close(). This caused blocking of future writes when the device was reopened if write_work was pending. The fix clears the HCI_UART_SENDING bit when canceling the work and improves safety by using disable_work_sync and enable_work instead of cancel_work_sync. The hci_uart_flush() function was also updated to purge the proto tx queue and properly cancel pending write_work, re-enabling or requeuing work as needed. This vulnerability is part of a broader set of Linux kernel security fixes addressing multiple subsystems and architectures.

This vulnerability could cause blocking of Bluetooth write operations after device reopen, potentially leading to denial of service or system instability. The CVSS score of 8.0 indicates high severity with high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported. The issue affects local users with some privileges (PR:L) and does not require user interaction (UI:N).

A patch is available and included in updated Linux kernel packages for affected versions. Users should apply the official Linux kernel updates provided by their distribution, such as the Ubuntu security notices USN-8726-1 and USN-8727-1, and reboot their systems to activate the fixes. Due to ABI changes, recompilation and reinstallation of third-party kernel modules may be necessary. No additional mitigation actions are required beyond applying the official updates.