CVE-2026-63974

Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close

State: Published
Severity: 8.8 High
Published: Jul 19, 2026
Updated: Oct 30, 2026
Reserved: Jul 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close

Since hci_dev_close_sync() can now be called during the reset path, we should also set HCI_CMD_DRAIN_WORKQUEUE. This avoids queuing timeouts while the hdev workqueue is being drained.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-400 Uncontrolled Resource Consumption

Affected Products

Product	Versions
LinuxLinux	877afadad2dce8aae1f2aad8ce47e072d4f6165e to before ccf07dfb9d7d1e2c7a1eeb782f90d9b614ebba9cAffected 877afadad2dce8aae1f2aad8ce47e072d4f6165e to before 7b81c1378b79c3143ca3fdb3d18ac0f01cbabb21Affected 877afadad2dce8aae1f2aad8ce47e072d4f6165e to before 9cebe4680bb9a72f80c6541eb24af06db7a1fbc9Affected 877afadad2dce8aae1f2aad8ce47e072d4f6165e to before 47330cc875b36a1cf7b3543cb2cf90a7c603ce0eAffected 877afadad2dce8aae1f2aad8ce47e072d4f6165e to before 60bceb9a4c693e68cc90ba4b2dfb9e000e8638ffAffected 877afadad2dce8aae1f2aad8ce47e072d4f6165e to before 525daaea459fc215f432de1b8debbd9144bf97b0Affected 4bf367fa1fefabdf14938d0ac9ed60020389112eAffected 3b382555706558f5c0587862b6dc03e96a252bbaAffected 5.18.18 to before 5.19Affected 5.19.2 to before 5.20Affected
LinuxLinux	6.0Affected before 6.0Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.93 through 6.12.Not affected 6.18.35 through 6.18.Not affected 7.0.12 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

877afadad2dce8aae1f2aad8ce47e072d4f6165e to before ccf07dfb9d7d1e2c7a1eeb782f90d9b614ebba9cAffected
877afadad2dce8aae1f2aad8ce47e072d4f6165e to before 7b81c1378b79c3143ca3fdb3d18ac0f01cbabb21Affected
877afadad2dce8aae1f2aad8ce47e072d4f6165e to before 9cebe4680bb9a72f80c6541eb24af06db7a1fbc9Affected
877afadad2dce8aae1f2aad8ce47e072d4f6165e to before 47330cc875b36a1cf7b3543cb2cf90a7c603ce0eAffected
877afadad2dce8aae1f2aad8ce47e072d4f6165e to before 60bceb9a4c693e68cc90ba4b2dfb9e000e8638ffAffected
877afadad2dce8aae1f2aad8ce47e072d4f6165e to before 525daaea459fc215f432de1b8debbd9144bf97b0Affected
4bf367fa1fefabdf14938d0ac9ed60020389112eAffected
3b382555706558f5c0587862b6dc03e96a252bbaAffected
5.18.18 to before 5.19Affected
5.19.2 to before 5.20Affected

LinuxLinux

6.0Affected
before 6.0Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.93 through 6.12.*Not affected
6.18.35 through 6.18.*Not affected
7.0.12 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.