CVE-2026-68085

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled<br /> <br /> HCI_UART_SENDING bit in tx_state means write_work is pending and blocks<br /> queueing it again. Currently this bit is not cleared when canceling the<br /> work in hci_uart_close(), which blocks future writes when device is<br /> reopened later if write_work was pending.<br /> <br /> Fix by clearing HCI_UART_SENDING when canceling the work.<br /> <br /> Also make clearing of tx_skb safe by using disable_work_sync +<br /> enable_work instead of just cancel_work_sync. hci_uart_flush() purges<br /> the proto tx queue so we can cancel the pending write_work there,<br /> instead of doing it just in hci_uart_close(). Re-enable and possibly<br /> requeue the work after queue flush.