CVE-2026-68085

Last refreshed2026-10-17

Status: UPDATED | Advisory ID: CVE-2026-68085

Key Details

CVE	CVE-2026-68085
CVSS Score / Version	8.0 (High) / CVSS v3.1
Updated	2026-10-16
CVSS Vector	`CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
CVSS Prose	attack vector is adjacent; attack complexity is low; privileges required is low; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products	Linux Kernel

Vendor	Product	Affected Versions	Patch Status
Linux	Linux Kernel

Vendor

Product

Affected Versions

Patch Status

Linux

Linux Kernel

Subsystems	OT Supporting Infrastructure
Sectors	All Sectors

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled

HCI_UART_SENDING bit in tx_state means write_work is pending and blocks

queueing it again. Currently this bit is not cleared when canceling the

work in hci_uart_close(), which blocks future writes when device is

reopened later if write_work was pending.

Fix by clearing HCI_UART_SENDING when canceling the work.

Also make clearing of tx_skb safe by using disable_work_sync +

enable_work instead of just cancel_work_sync. hci_uart_flush() purges

the proto tx queue so we can cancel the pending write_work there,

instead of doing it just in hci_uart_close(). Re-enable and possibly

requeue the work after queue flush. (NVD)

Monitor Linux's web page for any future patch releases.

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-68085
CVE	https://www.cve.org/CVERecord?id=CVE-2026-68085

Source

Reference

NVD

CVE