CVE-2026-63974Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close Since hci_dev_close_sync() can now be called during the reset path, we should also set HCI_CMD_DRAIN_WORKQUEUE. This avoids queuing timeouts while the hdev workqueue is being drained.
- CVSS
- 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Undergoing Analysis
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 877afadad2dce8aae1f2aad8ce47e072d4f6165e builds before 9cebe4680bb9a72f80c6541eb24af06db7a1fbc9; from 877afadad2dce8aae1f2aad8ce47e072d4f6165e before 47330cc875b36a1cf7b3543cb2cf90a7c603ce0e; 877afadad2dce8aae1f2aad8ce47e072d4f6165e builds before 60bceb9a4c693e68cc90ba4b2dfb9e000e8638ff; 877afadad2dce8aae1f2aad8ce47e072d4f6165e builds before 525daaea459fc215f432de1b8debbd9144bf97b0; 4bf367fa1fefabdf14938d0ac9ed60020389112e; 3b382555706558f5c0587862b6dc03e96a252bba; from 5.18.18 before 5.19; from 5.19.2 before 5.20 | CNA record |
References
- https://git.kernel.org/stable/c/9cebe4680bb9a72f80c6541eb24af06db7a1fbc9
- https://git.kernel.org/stable/c/47330cc875b36a1cf7b3543cb2cf90a7c603ce0e
- https://git.kernel.org/stable/c/60bceb9a4c693e68cc90ba4b2dfb9e000e8638ff
- https://git.kernel.org/stable/c/525daaea459fc215f432de1b8debbd9144bf97b0
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.