vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2026-63974

Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close

HIGH
8.8
CVSS Score
Published: July 19, 2026 at 02:55 PM UTC
Updated: October 30, 2026 at 01:19 PM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH8.8
Exploit prediction
EPSS 0.3%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close Since hci_dev_close_sync() can now be called during the reset path, we should also set HCI_CMD_DRAIN_WORKQUEUE. This avoids queuing timeouts while the hdev workqueue is being drained.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel· Linux
90%
3b382555706558f5c0587862b6dc03e96a252bba4bf367fa1fefabdf14938d0ac9ed60020389112e5.18.185.19.26.0877afadad2dce8aae1f2aad8ce47e072d4f6165e
Vendor states this is fixed in 47330cc875b36a1cf7b3543cb2cf90a7c603ce0e (fixed)
Vendor states this is fixed in 525daaea459fc215f432de1b8debbd9144bf97b0 (fixed)
Vendor states this is fixed in 60bceb9a4c693e68cc90ba4b2dfb9e000e8638ff (fixed)
Vendor states this is fixed in 9cebe4680bb9a72f80c6541eb24af06db7a1fbc9 (fixed)
Affected range stops below 5.19, so it looks safe — our inference, not a vendor statement
Affected range stops below 5.20, so it looks safe — our inference, not a vendor statement
Vendor states this is fixed in 6.0 (unaffected)
Vendor states this is fixed in 6.12.93 (unaffected)
Vendor states this is fixed in 6.18.35 (unaffected)
Vendor states this is fixed in 6.6.160 (unaffected)
Vendor states this is fixed in 7.0.12 (unaffected)
Vendor states this is fixed in 7.1 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (6)

Source: cverecord
https://git.kernel.org/stable/c/9cebe4680bb9a72f80c6541eb24af06db7a1fbc9
Source: cverecord
https://git.kernel.org/stable/c/47330cc875b36a1cf7b3543cb2cf90a7c603ce0e
Source: cverecord
https://git.kernel.org/stable/c/60bceb9a4c693e68cc90ba4b2dfb9e000e8638ff
Source: cverecord
https://git.kernel.org/stable/c/525daaea459fc215f432de1b8debbd9144bf97b0
Source: cverecord
https://git.kernel.org/stable/c/7b81c1378b79c3143ca3fdb3d18ac0f01cbabb21
Source: cverecord
https://git.kernel.org/stable/c/ccf07dfb9d7d1e2c7a1eeb782f90d9b614ebba9c

SSVC — Action Prioritization

SSVCNo known exploitNot automatableTotal impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

8.8HIGHLinux
Vector?

Quick Info

StatusUNDERGOING ANALYSIS
CWE
CWE-400

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card