Linux Kernel Bluetooth HCI Command Workqueue Drain Vulnerability

A vulnerability in the Linux kernel's Bluetooth subsystem has been addressed. The issue involved the HCI (Host Controller Interface) synchronization process, specifically during the closing of Bluetooth devices. The vulnerability could lead to queuing timeouts while the device's workqueue was being drained. This issue was resolved by ensuring that the HCI_CMD_DRAIN_WORKQUEUE command was set during the device closure process, particularly since the closure can now occur during the reset phase.

Impact

The vulnerability could cause unnecessary queuing timeouts, potentially leading to delays or disruptions in Bluetooth device management.

Reproduction

To reproduce this issue, initiate a Bluetooth device closure process while the device is in a reset phase. This will cause queuing timeouts as the device's workqueue is drained, leading to delays in the closure process.

Remediation

The vulnerability has been fixed in the Linux kernel stable tree. Users can upgrade to the latest version available in this repository to address the issue.