CVE-2026-63974

A flaw was found in the Bluetooth hci_sync component of the Linux kernel. When the hci_dev_close_sync() function is called during a device reset, the system may experience queuing timeouts. This occurs because the HCI_CMD_DRAIN_WORKQUEUE flag is not properly set, which can lead to system instability or a denial of service (DoS) condition.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, disable the Bluetooth service if it is not required. To disable the Bluetooth service: sudo systemctl stop bluetooth sudo systemctl disable bluetooth Alternatively, prevent the bluetooth kernel module from loading by creating a file /etc/modprobe.d/bluetooth.conf with the content blacklist bluetooth. Then, regenerate the initramfs using sudo dracut -f -v. A system reboot is required for the module blacklisting to take effect. Disabling Bluetooth may impact functionality that relies on Bluetooth connectivity.