CVE-2026-98109

A moderate impact flaw was found in the Linux kernel Bluetooth subsystem as shipped in Red Hat Enterprise Linux 9 and 10, RHIVOS 2.0 and 2.1, and Red Hat OpenShift 4.16 and later versions built on RHEL 9 CoreOS. During Bluetooth controller registration in hci_register_dev(), the power_on work item can be queued before internal data structures, including the Microsoft (MSFT) vendor extension data and its filter_lock mutex, are fully initialized. On devices marked with quirks such as HCI_QUIRK_RAW_DEVICE, a concurrently running hci_power_on() detects that the device is unconfigured and closes it, causing msft_do_close() to attempt to lock the not-yet-initialized mutex. This triggers a kernel lock debugging warning and can crash the kernel. A local user who can trigger Bluetooth device setup can win this race condition and cause a denial of service; confidentiality and integrity are not affected. Red Hat rates this flaw Moderate with a CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), while NIST assigns 4.7 (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H); both are Moderate and differ only in the assessed attack complexity. Earlier product versions, including RHEL 7, RHEL 8, earlier RHEL 9 minor streams, and OpenShift 4.15 and earlier, are not affected because the vulnerable code is not present in those kernels. Fixes for the affected streams are deferred to a future planned kernel update; the residual risk is considered low because successful exploitation requires local access with the ability to trigger Bluetooth device registration, must win a narrow initialization race window, and at worst results in a system crash or instability rather than any confidentiality or integrity impact.