Описание
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close
Since hci_dev_close_sync() can now be called during the reset path, we
should also set HCI_CMD_DRAIN_WORKQUEUE. This avoids queuing timeouts
while the hdev workqueue is being drained.
A flaw was found in the Bluetooth hci_sync component of the Linux kernel. When the hci_dev_close_sync() function is called during a device reset, the system may experience queuing timeouts. This occurs because the HCI_CMD_DRAIN_WORKQUEUE flag is not properly set, which can lead to system instability or a denial of service (DoS) condition.
Меры по смягчению последствий
To mitigate this issue, disable the Bluetooth service if it is not required.
To disable the Bluetooth service:
sudo systemctl stop bluetooth
sudo systemctl disable bluetooth
Alternatively, prevent the bluetooth kernel module from loading by creating a file /etc/modprobe.d/bluetooth.conf with the content blacklist bluetooth. Then, regenerate the initramfs using sudo dracut -f -v. A system reboot is required for the module blacklisting to take effect. Disabling Bluetooth may impact functionality that relies on Bluetooth connectivity.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Affected | ||
| Red Hat Enterprise Linux 10 | kernel | Fixed | RHSA-2026:83207 | 15.10.2026 |
| Red Hat Enterprise Linux 9 | kernel | Fixed | RHSA-2026:86033 | 20.10.2026 |
| Red Hat Enterprise Linux 9 | kernel | Fixed | RHSA-2026:86033 | 20.10.2026 |
| Shadow Migration Toolkit for Virtualization for RHEL 10 | kernel | Fixed | RHSA-2026:83207 | 15.10.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
7.3 High
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close Since hci_dev_close_sync() can now be called during the reset path, we should also set HCI_CMD_DRAIN_WORKQUEUE. This avoids queuing timeouts while the hdev workqueue is being drained.
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close Since hci_dev_close_sync() can now be called during the reset path, we should also set HCI_CMD_DRAIN_WORKQUEUE. This avoids queuing timeouts while the hdev workqueue is being drained.
Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close
In the Linux kernel, the following vulnerability has been resolved: B ...
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close Since hci_dev_close_sync() can now be called during the reset path, we should also set HCI_CMD_DRAIN_WORKQUEUE. This avoids queuing timeouts while the hdev workqueue is being drained.
EPSS
7.3 High
CVSS3