CVE-2026-63974
Received Received - Intake

Bluetooth Stack Command Timeout in Linux Kernel

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close Since hci_dev_close_sync() can now be called during the reset path, we should also set HCI_CMD_DRAIN_WORKQUEUE. This avoids queuing timeouts while the hdev workqueue is being drained.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63974
EUVD
EUVD-2026-45747

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability affecting the Bluetooth subsystem. It involves a missing flag during device close operations. When hci_dev_close_sync() is called during a reset, the HCI_CMD_DRAIN_WORKQUEUE flag should be set to prevent queuing timeouts while the device workqueue is being drained.

Detection Guidance

This vulnerability is specific to the Linux kernel's Bluetooth subsystem and does not have direct network detection methods. Detection involves checking kernel logs for Bluetooth-related errors or timeouts during device operations. Use commands like dmesg | grep -i bluetooth or journalctl -k | grep -i bluetooth to review kernel logs for Bluetooth-related issues.

Impact Analysis

This vulnerability could cause Bluetooth device operations to hang or time out during reset or close operations. It may lead to temporary loss of Bluetooth functionality or system instability in affected Linux systems.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or other common standards and regulations. The issue is specific to the Linux kernel's Bluetooth subsystem and involves a timing problem during device close operations. There is no indication that this vulnerability impacts data protection, privacy, or security controls required by these regulations.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this vulnerability. Monitor vendor advisories for kernel updates and apply them promptly. No additional configuration changes are required beyond the kernel update.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63974. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart