CVE-2026-63974: Linux Kernel Bluetooth DoS Vulnerability

CVE-2026-63974 Overview

CVE-2026-63974 is a Linux kernel vulnerability in the Bluetooth hci_sync subsystem. The flaw stems from hci_dev_close_sync() being callable during the reset path without setting the HCI_CMD_DRAIN_WORKQUEUE flag. This omission allows command timeouts to be queued while the hdev workqueue is being drained, creating a race condition in the Host Controller Interface (HCI) command handling logic. The issue impacts kernel Bluetooth stability and can be triggered by an adjacent-network attacker within Bluetooth range. Upstream maintainers resolved the issue by setting the drain flag during device close operations.

Critical Impact
An adjacent attacker within Bluetooth range can trigger a kernel race condition leading to memory corruption, denial of service, or potential privilege escalation on affected Linux systems.

Affected Products

Linux kernel Bluetooth subsystem (net/bluetooth/hci_sync.c)
Distributions shipping vulnerable stable kernel branches prior to the referenced fix commits
Any Linux-based device with an active Bluetooth HCI interface

Discovery Timeline

2026-07-19 - CVE-2026-63974 published to the National Vulnerability Database
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-63974

Vulnerability Analysis

The vulnerability resides in the Bluetooth HCI synchronization code path within the Linux kernel. The function hci_dev_close_sync() is invoked when a Bluetooth device is shut down or reset. During the reset path, the kernel drains the hdev workqueue to complete pending HCI commands before teardown. Without the HCI_CMD_DRAIN_WORKQUEUE flag being set, new command timeout entries can be queued onto the workqueue while it is already being drained. This creates a race window where work items reference structures that are being torn down. On adjacent networks, an attacker who can influence Bluetooth device state transitions may trigger this race and drive the kernel into an inconsistent state.

Root Cause

The root cause is a missing state flag in the kernel Bluetooth close path (kernel vulnerability, race condition). Because hci_dev_close_sync() gained a new caller in the reset path, the existing assumption that only explicit device-close operations needed workqueue draining protection became invalid. The flag HCI_CMD_DRAIN_WORKQUEUE gates whether timeout work items may still be scheduled, and its absence during reset allowed unsafe concurrent scheduling.

Attack Vector

Exploitation requires proximity to the target device such that an attacker can interact with its Bluetooth radio, matching the CVSS Adjacent Network (AV:A) vector. An attacker who can force repeated resets or manipulate link state — for example by sending malformed link management traffic — may drive the kernel through the vulnerable reset path and trigger the race. No authentication or user interaction is required. Technical details are available in the upstream fix commits, including kernel commit 525daaea and kernel commit 60bceb9a.

Detection Methods for CVE-2026-63974

Indicators of Compromise

Kernel log entries referencing Bluetooth HCI command timeouts (hci_cmd_timeout) coinciding with device reset operations
Repeated hci0 interface up/down transitions or unexplained Bluetooth adapter resets
Kernel oops or workqueue-related warnings originating in net/bluetooth/hci_sync.c

Detection Strategies

Monitor dmesg and journalctl -k for Bluetooth stack warnings, workqueue stalls, or use-after-free reports from KASAN-enabled kernels
Correlate Bluetooth adapter state churn with process crashes or system instability on Linux endpoints
Track installed kernel package versions across the fleet and flag hosts running kernels prior to the fix commits

Monitoring Recommendations

Ingest kernel and audit logs into a centralized analytics pipeline to detect anomalous Bluetooth subsystem behavior
Alert on unexpected rfkill events or Bluetooth service restarts on servers and workstations that do not normally use Bluetooth
Baseline Bluetooth activity per host and investigate deviations, particularly in shared-space environments

How to Mitigate CVE-2026-63974

Immediate Actions Required

Apply the latest stable Linux kernel update from your distribution vendor that includes the HCI_CMD_DRAIN_WORKQUEUE fix
Disable the Bluetooth stack on systems that do not require it by unloading the bluetooth and btusb modules
Inventory Linux endpoints and servers with active Bluetooth radios and prioritize patching for portable and shared-use devices

Patch Information

The fix has been merged into the mainline Linux kernel and backported to stable branches. Refer to the upstream commits: kernel commit 47330cc8, kernel commit 525daaea, kernel commit 60bceb9a, and kernel commit 9cebe468. Rebuild custom kernels against the patched sources or install the updated vendor package.

Workarounds

Blacklist the Bluetooth kernel modules on systems that do not need Bluetooth connectivity
Physically disable Bluetooth radios via BIOS/UEFI on servers and fixed-location workstations
Restrict Bluetooth pairing and discoverability on mobile Linux endpoints to reduce adjacent attack exposure

bash

# Disable Bluetooth kernel modules until patched kernel is installed
sudo systemctl stop bluetooth.service
sudo systemctl disable bluetooth.service
echo 'blacklist bluetooth' | sudo tee /etc/modprobe.d/disable-bluetooth.conf
echo 'blacklist btusb'     | sudo tee -a /etc/modprobe.d/disable-bluetooth.conf
sudo rmmod btusb bluetooth 2>/dev/null
sudo update-initramfs -u