CVE-2026-63974

Source
https://cve.org/CVERecord?id=CVE-2026-63974
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63974.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-63974
Downstream
AZL (1)
BELL (1)
DEBIAN (1)
OESA (2)
openSUSE (1)
RHSA (1)
RLSA (2)
ROOT (1)
SUSE (11)
UBUNTU (1)
Related
Published
2026-07-19T14:55:59Z
Modified
2026-10-24T02:30:44Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close
Details

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close

Since hci_dev_close_sync() can now be called during the reset path, we should also set HCI_CMD_DRAIN_WORKQUEUE. This avoids queuing timeouts while the hdev workqueue is being drained.

Database specific
{
    "cna_assigner":  "Linux",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63974.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
877afadad2dce8aae1f2aad8ce47e072d4f6165e
Fixed
7b81c1378b79c3143ca3fdb3d18ac0f01cbabb21
Fixed
9cebe4680bb9a72f80c6541eb24af06db7a1fbc9
Fixed
47330cc875b36a1cf7b3543cb2cf90a7c603ce0e
Fixed
60bceb9a4c693e68cc90ba4b2dfb9e000e8638ff
Fixed
525daaea459fc215f432de1b8debbd9144bf97b0
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
5.18.18
Fixed
5.19
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
5.19.2
Fixed
5.20
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
4bf367fa1fefabdf14938d0ac9ed60020389112e
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
3b382555706558f5c0587862b6dc03e96a252bba

Affected versions

v5.*
v5.18.18
v5.18.19
v5.19.10
v5.19.11
v5.19.12
v5.19.13
v5.19.14
v5.19.15
v5.19.16
v5.19.17
v5.19.2
v5.19.3
v5.19.4
v5.19.5
v5.19.6
v5.19.7
v5.19.8
v5.19.9

Database specific

source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63974.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.0.0
Fixed
6.6.160
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.93
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.35
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.0.12

Database specific

source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63974.json"