---
id: CVE-2026-63974
title: 'Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close

  Since hci_dev_close_sync() can now be called during the reset path, we
  should also set HCI_CMD_DRA…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 877afadad2dce8aae1f2aad8ce47e072d4f6165e <
    9cebe4680bb9a72f80c6541eb24af06db7a1fbc9
  - >-
    Linux >= 877afadad2dce8aae1f2aad8ce47e072d4f6165e <
    47330cc875b36a1cf7b3543cb2cf90a7c603ce0e
  - >-
    Linux >= 877afadad2dce8aae1f2aad8ce47e072d4f6165e <
    60bceb9a4c693e68cc90ba4b2dfb9e000e8638ff
  - >-
    Linux >= 877afadad2dce8aae1f2aad8ce47e072d4f6165e <
    525daaea459fc215f432de1b8debbd9144bf97b0
  - Linux 4bf367fa1fefabdf14938d0ac9ed60020389112e
  - Linux 3b382555706558f5c0587862b6dc03e96a252bba
  - Linux >= 5.18.18 < 5.19
  - Linux >= 5.19.2 < 5.20
  - Linux 6.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:34:21.021938Z'
published: '2026-07-19'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:42:15.222Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-63974'
references:
  - url: 'https://git.kernel.org/stable/c/9cebe4680bb9a72f80c6541eb24af06db7a1fbc9'
  - url: 'https://git.kernel.org/stable/c/47330cc875b36a1cf7b3543cb2cf90a7c603ce0e'
  - url: 'https://git.kernel.org/stable/c/60bceb9a4c693e68cc90ba4b2dfb9e000e8638ff'
  - url: 'https://git.kernel.org/stable/c/525daaea459fc215f432de1b8debbd9144bf97b0'
tags:
  - cve.org
epss: 0.00317
epssPercentile: 0.23082
ingestedAt: '2026-10-16T17:24:46.785Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close

Since hci_dev_close_sync() can now be called during the reset path, we
should also set HCI_CMD_DRAIN_WORKQUEUE. This avoids queuing timeouts
while the hdev workqueue is being drained.

## Affected

- `Linux >= 877afadad2dce8aae1f2aad8ce47e072d4f6165e < 9cebe4680bb9a72f80c6541eb24af06db7a1fbc9`
- `Linux >= 877afadad2dce8aae1f2aad8ce47e072d4f6165e < 47330cc875b36a1cf7b3543cb2cf90a7c603ce0e`
- `Linux >= 877afadad2dce8aae1f2aad8ce47e072d4f6165e < 60bceb9a4c693e68cc90ba4b2dfb9e000e8638ff`
- `Linux >= 877afadad2dce8aae1f2aad8ce47e072d4f6165e < 525daaea459fc215f432de1b8debbd9144bf97b0`
- `Linux 4bf367fa1fefabdf14938d0ac9ed60020389112e`
- `Linux 3b382555706558f5c0587862b6dc03e96a252bba`
- `Linux >= 5.18.18 < 5.19`
- `Linux >= 5.19.2 < 5.20`
- `Linux 6.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.