🟡 Medium | Source: Microsoft Security Response Center
CVE-2026-63974 is a Linux kernel vulnerability affecting the Bluetooth HCI (Host Controller Interface) subsystem, specifically in the hci_sync component. The flaw relates to improper handling of the HCI_CMD_DRAIN_WORKQUEUE flag during device close operations, which can lead to race conditions or use-after-free scenarios. While published via Microsoft’s Security Response Center in the context of Azure, the underlying issue originates in the Linux kernel and may affect Azure Linux-based virtual machines and containerised workloads.
Security Architect’s Take: Review whether your Azure Linux VM images or AKS node pools are running kernel versions affected by this vulnerability, and prioritise patching via your standard kernel update process or Azure’s automatic guest OS patching where applicable. If Bluetooth is not required on your workloads — as is typical in cloud environments — confirm it is disabled at the kernel or OS level to reduce the attack surface.
Original advisory: CVE-2026-63974 Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close