CVE-2026-63974 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close
Since hci_dev_close_sync() can now be called during the reset path, we should also set HCI_CMD_DRAIN_WORKQUEUE. This avoids queuing timeouts while the hdev workqueue is being drained.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/19/2026
This vulnerability resides within the Linux kernel's Bluetooth subsystem, specifically in the HCI (Host Controller Interface) synchronization mechanisms that govern how Bluetooth devices communicate with the host system. The issue manifests when the hci_dev_close_sync() function is invoked during the device reset process, creating a scenario where command queue management becomes inconsistent and potentially leads to race conditions or improper timeout handling within the Bluetooth stack.
The technical flaw stems from an incomplete state management approach in the Bluetooth device closure logic. When a Bluetooth device undergoes a reset operation, the system attempts to close the device properly while simultaneously draining the workqueue that handles HCI commands. However, the existing code fails to set the HCI_CMD_DRAIN_WORKQUEUE flag during this specific sequence, which is crucial for maintaining proper synchronization between command processing and queue cleanup operations.
The operational impact of this vulnerability extends beyond simple functional failures to potentially compromise system stability and security. During device reset scenarios, improper handling of workqueue draining can result in command timeouts being queued while the underlying workqueue is already in the process of being cleared, leading to unpredictable behavior that might manifest as system hangs, memory corruption, or denial of service conditions. This vulnerability particularly affects systems where Bluetooth devices undergo frequent resets or where the kernel's Bluetooth subsystem handles high-frequency command processing.
The mitigation strategy involves ensuring that the HCI_CMD_DRAIN_WORKQUEUE flag is properly set whenever hci_dev_close_sync() executes during reset operations, which maintains consistency in workqueue management and prevents the queuing of timeouts during the draining process. This fix aligns with proper kernel development practices for concurrent access control and resource cleanup operations, addressing potential issues that could be exploited through carefully crafted Bluetooth device operations or system stress conditions. The vulnerability demonstrates the importance of maintaining proper synchronization states in kernel-level subsystems where multiple threads or processes may interact with shared resources during critical operations.
This issue relates to CWE-362 which addresses concurrent execution using shared resource vulnerabilities, and could potentially map to ATT&CK technique T1059.007 for command and scripting interpreter usage in kernel contexts. The fix ensures proper state management during device lifecycle operations and prevents race conditions that could be exploited by malicious actors attempting to disrupt Bluetooth connectivity or cause system instability through crafted device reset sequences.