What is the CVSS score of EUVD-2026-45747?

EUVD-2026-45747 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Linux Kernel are affected by EUVD-2026-45747?

A kernel vulnerability in the Linux Bluetooth stack (CVE-2026-63974, CVSS 8.8) could allow local attackers to disrupt Bluetooth services or corrupt memory on affected systems; however, no public…. A patch is available.

How to fix or mitigate EUVD-2026-45747?

Within 24 hours, identify and catalog all Linux systems running kernel versions prior to 6.12.93, 6.18.35, 7.0.12, or 7.1 that have Bluetooth enabled. Within 7 days, begin deployment of patched kernel versions (6.12.93, 6.18.35, 7.0.12, or 7.1 depending on release branch) to systems with active Bluetooth usage. Complete patching of all affected systems within 30 days, and audit Bluetooth configurations to disable the service on systems where it is not operationally required.

Linux Kernel EUVD-2026-45747

| CVE-2026-63974 HIGH

2026-07-19 Linux

GHSA-7hr8-6q2g-wqfg

Information Disclosure Linux

High

Disputed · 8.8 Vendor: Linux

Severity by source

Sources disagree (Low–High)

Vendor (Linux) PRIMARY

8.8 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

5.3 MEDIUM

Bluetooth-adjacent (AV:A); a timing-dependent teardown race justifies AC:H; described impact is teardown instability/DoS (A:H) with no evidenced confidentiality or integrity effect, so C:N/I:N pending CWE confirmation.

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:A/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

5.5 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 16:36 vuln.today

CVSS changed

Jul 20, 2026 - 15:22 NVD

8.8 (HIGH)

Patch available

Jul 19, 2026 - 17:19 EUVD

CVE Published

Jul 19, 2026 - 14:55 cve.org

HIGH 8.8

CVE Published

Jul 19, 2026 - 14:55 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close

Since hci_dev_close_sync() can now be called during the reset path, we should also set HCI_CMD_DRAIN_WORKQUEUE. This avoids queuing timeouts while the hdev workqueue is being drained.

AnalysisAI

Denial-of-service and potential memory-corruption exposure in the Linux kernel Bluetooth stack (hci_sync) arises because hci_dev_close_sync() failed to set the HCI_CMD_DRAIN_WORKQUEUE flag during device close, allowing command timeouts to be queued while the hdev workqueue is being drained on the reset path. The fix, present in stable trees (6.12.93, 6.18.35, 7.0.12, 7.1), closes a race that a Bluetooth-adjacent attacker could trigger during controller reset. There is no public exploit identified at time of analysis, EPSS risk is low (0.20%), and it is not listed in CISA KEV.

Technical ContextAI

The affected component is the Linux kernel Bluetooth Host Controller Interface synchronization layer (net/bluetooth/hci_sync.c). HCI commands are dispatched through a per-device (hdev) workqueue, and each command arms a timeout work item. When a device is closed via hci_dev_close_sync() - a code path that can now be reached during controller reset - the workqueue is drained. Without the HCI_CMD_DRAIN_WORKQUEUE flag being set, new command-timeout work could still be enqueued onto a workqueue that is mid-drain, creating a race window between teardown and pending work. This is a classic concurrency/lifetime hazard (use-after-free / race-during-teardown class); note the input reports CWE as N/A, so the exact weakness class is not authoritatively assigned. CPE data identifies the vendor/product only generically as cpe:2.3:a:linux:linux:*, with the specific subsystem being Bluetooth.

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 6.12.93, 6.18.35, 7.0.12, or 7.1, or backport the fix commits (9cebe4680bb9a72f80c6541eb24af06db7a1fbc9, 47330cc875b36a1cf7b3543cb2cf90a7c603ce0e, 60bceb9a4c693e68cc90ba4b2dfb9e000e8638ff, 525daaea459fc215f432de1b8debbd9144bf97b0) from git.kernel.org/stable. Apply the distribution kernel update matching your branch and reboot. As a compensating control until patched, disable or unload the Bluetooth stack on systems that do not require it (e.g. 'rmmod btusb bluetooth' / blacklist the modules, or 'rfkill block bluetooth'), which removes the attack surface entirely at the cost of losing Bluetooth functionality; where Bluetooth is required, restrict physical/RF proximity and disable the radio when not in use, since the vector is adjacent rather than network-wide. Reference advisory and commits: https://nvd.nist.gov/vuln/detail/CVE-2026-63974.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

EUVD-2026-45747 vulnerability details – vuln.today

Back

Linux Kernel EUVD-2026-45747

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code