« Volver al listado

CVE-2026-68085

Estado: RecibidaAlta (8)—

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled

HCI_UART_SENDING bit in tx_state means write_work is pending and blocks queueing it again. Currently this bit is not cleared when canceling the work in hci_uart_close(), which blocks future writes when device is reopened later if write_work was pending.

Fix by clearing HCI_UART_SENDING when canceling the work.

Also make clearing of tx_skb safe by using disable_work_sync + enable_work instead of just cancel_work_sync. hci_uart_flush() purges the proto tx queue so we can cancel the pending write_work there, instead of doing it just in hci_uart_close(). Re-enable and possibly requeue the work after queue flush.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:A (red adyacente) + PR:L sugiere T1210, pero la vulnerabilidad es de kernel Linux de bajo nivel (manejo de estado en Bluetooth/UART) sin evidencia explícita de explotación remota; el impacto es DoS por bloqueo de escrituras (A:H).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Vulnerability ScanningThreat Intelligence ProgramPrivileged Account ManagementNetwork SegmentationFilter Network TrafficDisable or Remove Feature or Program

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-68085",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.1
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "81c7a3c22a0f2808cf4ae0b4908f59763b23606d",
              "lessThan": "d52446b3e735cfdbdc2a58342163803bc2e64249",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "192cb0f1ca706d9a1bc36ae0ad5f666d1e4fd894",
              "lessThan": "b9dd39cf1667e378b25a082ca796d495d578c5d3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c1bb9336ae6b54a5f6a353c4bd4ed9a4307e429b",
              "lessThan": "714d861d35d937f23375a4517569b13917bbbe51",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c1bb9336ae6b54a5f6a353c4bd4ed9a4307e429b",
              "lessThan": "1b0d946d6f08bd39211385bc703a440911b41e46",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "78aad93e938f013d9272fe0ee168f27883afa95c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e2d19969c8d9198ecc3090bcd5312ecd503a3339",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c85cff648a2bc92322912db5f1727ad05afae7b6",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9d20d48be2c4a071fb015eb09bda2cecd25daf34",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "7338031946bd06f6dff149e67b60c4cd083bfea8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "6.12.92",
              "lessThan": "6.12.96",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "6.18.34",
              "lessThan": "6.18.39",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "5.10.258",
              "lessThan": "5.11",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "5.15.209",
              "lessThan": "5.16",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "6.1.175",
              "lessThan": "6.2",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "6.6.142",
              "lessThan": "6.7",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "7.0.11",
              "lessThan": "7.1",
              "versionType": "semver"
            }
          ],
          "programFiles": [
            "drivers/bluetooth/hci_ldisc.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.1"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "7.1",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/bluetooth/hci_ldisc.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-08-10T12:17:21.060",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/1b0d946d6f08bd39211385bc703a440911b41e46",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/714d861d35d937f23375a4517569b13917bbbe51",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b9dd39cf1667e378b25a082ca796d495d578c5d3",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d52446b3e735cfdbdc2a58342163803bc2e64249",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled\n\nHCI_UART_SENDING bit in tx_state means write_work is pending and blocks\nqueueing it again.  Currently this bit is not cleared when canceling the\nwork in hci_uart_close(), which blocks future writes when device is\nreopened later if write_work was pending.\n\nFix by clearing HCI_UART_SENDING when canceling the work.\n\nAlso make clearing of tx_skb safe by using disable_work_sync +\nenable_work instead of just cancel_work_sync.  hci_uart_flush() purges\nthe proto tx queue so we can cancel the pending write_work there,\ninstead of doing it just in hci_uart_close().  Re-enable and possibly\nrequeue the work after queue flush."
    }
  ],
  "lastModified": "2026-08-17T05:18:07.737",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}