{"id":"CVE-2026-63974","title":"Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close\n\nSince hci_dev_close_sync() can now be called during the reset path, we\nshould also set HCI_CMD_DRA…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 877afadad2dce8aae1f2aad8ce47e072d4f6165e < 9cebe4680bb9a72f80c6541eb24af06db7a1fbc9","Linux >= 877afadad2dce8aae1f2aad8ce47e072d4f6165e < 47330cc875b36a1cf7b3543cb2cf90a7c603ce0e","Linux >= 877afadad2dce8aae1f2aad8ce47e072d4f6165e < 60bceb9a4c693e68cc90ba4b2dfb9e000e8638ff","Linux >= 877afadad2dce8aae1f2aad8ce47e072d4f6165e < 525daaea459fc215f432de1b8debbd9144bf97b0","Linux 4bf367fa1fefabdf14938d0ac9ed60020389112e","Linux 3b382555706558f5c0587862b6dc03e96a252bba","Linux >= 5.18.18 < 5.19","Linux >= 5.19.2 < 5.20","Linux 6.0"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T15:34:21.021938Z"},"published":"2026-07-19","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:42:15.222Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-63974","references":[{"url":"https://git.kernel.org/stable/c/9cebe4680bb9a72f80c6541eb24af06db7a1fbc9"},{"url":"https://git.kernel.org/stable/c/47330cc875b36a1cf7b3543cb2cf90a7c603ce0e"},{"url":"https://git.kernel.org/stable/c/60bceb9a4c693e68cc90ba4b2dfb9e000e8638ff"},{"url":"https://git.kernel.org/stable/c/525daaea459fc215f432de1b8debbd9144bf97b0"}],"tags":["cve.org"],"epss":0.00317,"epssPercentile":0.23082,"ingestedAt":"2026-10-16T17:24:46.785Z","slug":"CVE-2026-63974","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close\n\nSince hci_dev_close_sync() can now be called during the reset path, we\nshould also set HCI_CMD_DRAIN_WORKQUEUE. This avoids queuing timeouts\nwhile the hdev workqueue is being drained.\n\n## Affected\n\n- `Linux >= 877afadad2dce8aae1f2aad8ce47e072d4f6165e < 9cebe4680bb9a72f80c6541eb24af06db7a1fbc9`\n- `Linux >= 877afadad2dce8aae1f2aad8ce47e072d4f6165e < 47330cc875b36a1cf7b3543cb2cf90a7c603ce0e`\n- `Linux >= 877afadad2dce8aae1f2aad8ce47e072d4f6165e < 60bceb9a4c693e68cc90ba4b2dfb9e000e8638ff`\n- `Linux >= 877afadad2dce8aae1f2aad8ce47e072d4f6165e < 525daaea459fc215f432de1b8debbd9144bf97b0`\n- `Linux 4bf367fa1fefabdf14938d0ac9ed60020389112e`\n- `Linux 3b382555706558f5c0587862b6dc03e96a252bba`\n- `Linux >= 5.18.18 < 5.19`\n- `Linux >= 5.19.2 < 5.20`\n- `Linux 6.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}