CVE-2026-63974: Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close

Q: What conditions are required for exploitation?

The issue is reachable over an adjacent network attack vector and requires no privileges or user interaction, according to the supplied severity vector. The description specifically involves Bluetooth HCI device close and reset handling while the device workqueue is being drained.

Q: What is the impact if the issue is exploited?

The supplied severity vector rates confidentiality, integrity, and availability impacts as high. The underlying flaw concerns timeouts being queued while the HCI device workqueue is draining.

Q: What should be done to remediate it?

Update to a Linux kernel build that includes the fix which sets HCI_CMD_DRAIN_WORKQUEUE during device close. The provided references include stable-kernel commits for the remediation.

Published Jul 19, 2026

Updated

Bluetooth: hcisync: Set HCICMDDRAINWORKQUEUE during device close

Affected Software

10 affected componentsFixes available

Linux Linux kernel

debian/linux*

debian/linux<6.12.94-1

6.12.94-1

debian/linux<7.0.12-1

7.0.12-1

linux/kernel>=6.0.0<6.1.191

6.1.191

linux/kernel>=6.2.0<6.6.160

6.6.160

linux/kernel>=6.7.0<6.12.93

6.12.93

linux/kernel>=6.13.0<6.18.35

6.18.35

linux/kernel>=6.19.0<7.0.12

7.0.12

debian/linux<=6.1.176-1, <=6.1.190-1

6.12.107-16.12.115-27.2.12-17.2.15-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/linux to a version that resolves this vulnerability.
Fixed in 6.12.94-1
Upgrade
Upgrade debian/linux to a version that resolves this vulnerability.
Fixed in 7.0.12-1
Upgrade
Upgrade linux/Kernel to a version that resolves this vulnerability.
Fixed in 6.1.191
Upgrade
Upgrade linux/Kernel to a version that resolves this vulnerability.
Fixed in 6.6.160
Upgrade
Upgrade linux/Kernel to a version that resolves this vulnerability.
Fixed in 6.12.93
Upgrade
Upgrade linux/Kernel to a version that resolves this vulnerability.
Fixed in 6.18.35
Upgrade
Upgrade linux/Kernel to a version that resolves this vulnerability.
Fixed in 7.0.12
Upgrade
Upgrade debian/linux to a version that resolves this vulnerability.
Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1
Configuration
Set HCI_CMD_DRAIN_WORKQUEUE during hci_dev_close_sync() device close, including when called during the reset path, to avoid queuing timeouts while the hdev workqueue is being drained.
Linux kernel Bluetooth hci_sync HCI_CMD_DRAIN_WORKQUEUE = set during device close

Event History

Jul 19, 2026

CVE Published

via MITRE·02:55 PM

Data Sourced

via MITRE·02:55 PM

DescriptionSeverity

Data Sourced

via OSV·02:55 PM

DescriptionSeverityAffected Software

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Jul 21, 2026

Data Sourced

via Microsoft·08:05 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What conditions are required for exploitation?

The issue is reachable over an adjacent network attack vector and requires no privileges or user interaction, according to the supplied severity vector. The description specifically involves Bluetooth HCI device close and reset handling while the device workqueue is being drained.

What is the impact if the issue is exploited?

The supplied severity vector rates confidentiality, integrity, and availability impacts as high. The underlying flaw concerns timeouts being queued while the HCI device workqueue is draining.

What should be done to remediate it?

Update to a Linux kernel build that includes the fix which sets HCI_CMD_DRAIN_WORKQUEUE during device close. The provided references include stable-kernel commits for the remediation.

CVE-2026-63974: Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close

Affected Software

Remediation

Event History

Frequently Asked Questions

What conditions are required for exploitation?

What is the impact if the issue is exploited?

What should be done to remediate it?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required for exploitation?

What is the impact if the issue is exploited?

What should be done to remediate it?