CVE-2026-63974 - Vulnerability Details - OpenCVE

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close Since hci_dev_close_sync() can now be called during the reset path, we should also set HCI_CMD_DRAIN_WORKQUEUE. This avoids queuing timeouts while the hdev workqueue is being drained.

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.002.

Key SSVC decision points have not yet been added.

Vendors	Products
Linux	Linux Kernel

No data.

No data.

No data.

References

Link	Providers
https://git.kernel.org/stable/c/47330cc875b36a1cf7b3543cb2cf90a7c603ce0e
https://git.kernel.org/stable/c/525daaea459fc215f432de1b8debbd9144bf97b0
https://git.kernel.org/stable/c/60bceb9a4c693e68cc90ba4b2dfb9e000e8638ff
https://git.kernel.org/stable/c/9cebe4680bb9a72f80c6541eb24af06db7a1fbc9

History

Mon, 20 Jul 2026 14:45:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sun, 19 Jul 2026 15:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close Since hci_dev_close_sync() can now be called during the reset path, we should also set HCI_CMD_DRAIN_WORKQUEUE. This avoids queuing timeouts while the hdev workqueue is being drained.
Title		Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/47330cc875b36a1cf7b3543cb2cf90a7c603ce0e https://git.kernel.org/stable/c/525daaea459fc215f432de1b8debbd9144bf97b0 https://git.kernel.org/stable/c/60bceb9a4c693e68cc90ba4b2dfb9e000e8638ff https://git.kernel.org/stable/c/9cebe4680bb9a72f80c6541eb24af06db7a1fbc9

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-19T14:55:59.994Z

Updated: 2026-07-20T13:41:58.081Z

Reserved: 2026-07-19T07:54:57.024Z

Link: CVE-2026-63974

Vulnrichment

No data.

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-63974", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T07:54:57.024Z", "datePublished": "2026-07-19T14:55:59.994Z", "dateUpdated": "2026-07-20T13:41:58.081Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-07-20T13:41:58.081Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close\n\nSince hci_dev_close_sync() can now be called during the reset path, we\nshould also set HCI_CMD_DRAIN_WORKQUEUE. This avoids queuing timeouts\nwhile the hdev workqueue is being drained."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bluetooth/hci_sync.c"], "versions": [{"version": "877afadad2dce8aae1f2aad8ce47e072d4f6165e", "lessThan": "9cebe4680bb9a72f80c6541eb24af06db7a1fbc9", "status": "affected", "versionType": "git"}, {"version": "877afadad2dce8aae1f2aad8ce47e072d4f6165e", "lessThan": "47330cc875b36a1cf7b3543cb2cf90a7c603ce0e", "status": "affected", "versionType": "git"}, {"version": "877afadad2dce8aae1f2aad8ce47e072d4f6165e", "lessThan": "60bceb9a4c693e68cc90ba4b2dfb9e000e8638ff", "status": "affected", "versionType": "git"}, {"version": "877afadad2dce8aae1f2aad8ce47e072d4f6165e", "lessThan": "525daaea459fc215f432de1b8debbd9144bf97b0", "status": "affected", "versionType": "git"}, {"version": "4bf367fa1fefabdf14938d0ac9ed60020389112e", "status": "affected", "versionType": "git"}, {"version": "3b382555706558f5c0587862b6dc03e96a252bba", "status": "affected", "versionType": "git"}, {"version": "5.18.18", "lessThan": "5.19", "status": "affected", "versionType": "semver"}, {"version": "5.19.2", "lessThan": "5.20", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bluetooth/hci_sync.c"], "versions": [{"version": "6.0", "status": "affected"}, {"version": "0", "lessThan": "6.0", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.93", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.35", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.12", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.12.93"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.18.35"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "7.0.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "7.1"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18.18"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/9cebe4680bb9a72f80c6541eb24af06db7a1fbc9"}, {"url": "https://git.kernel.org/stable/c/47330cc875b36a1cf7b3543cb2cf90a7c603ce0e"}, {"url": "https://git.kernel.org/stable/c/60bceb9a4c693e68cc90ba4b2dfb9e000e8638ff"}, {"url": "https://git.kernel.org/stable/c/525daaea459fc215f432de1b8debbd9144bf97b0"}], "title": "Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close", "x_generator": {"engine": "bippy-1.2.0"}}}}