A vulnerability in the Linux kernel Bluetooth HCI UART subsystem may lead to a permanent denial of service for Bluetooth communications on affected devices.

The issue exists within the hci_uart_close function, where the HCI_UART_SENDING bit is not correctly cleared when canceling pending work. This state mismatch prevents the subsystem from processing future writes when the device is reopened, requiring low-privileged local or adjacent access to trigger the failure.

The vulnerability carries a CVSS score of 8.0, reflecting its potential to disrupt critical system communications. Successful exploitation causes a persistent denial of service of the Bluetooth subsystem, which can impact industrial systems, mobile devices, or peripheral connectivity that rely on Bluetooth for operational continuity.

Immediate Action: Update the Linux kernel to version 6.12.96, 6.18.39, 7.1.4, or a later stable release provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for Bluetooth driver initialization errors or repeated failures in HCI UART communication queues.

Compensating Controls: Restrict access to Bluetooth-enabled hardware interfaces to authorized users and disable Bluetooth services on systems where they are not strictly required for business operations.

Public Exploit Available: No

Given the core nature of the Linux kernel and the potential for persistent communication loss, administrators should prioritize applying the provided patches during the next scheduled maintenance window. Because this flaw affects the fundamental state machine of the Bluetooth HCI driver, patching is the only reliable method to ensure long-term stability and security of the affected hardware interfaces.