CVE-2026-46056

A flaw was found in the Linux kernel's Bluetooth subsystem. This vulnerability, a Use-After-Free (UAF), exists within the Secure Simple Pairing (SSP) passkey handlers. It occurs when hci_conn lookup and field access are performed without proper locking, allowing a connection to be freed concurrently. This could potentially enable a local attacker to cause a denial of service or execute arbitrary code.

This vulnerability is rated as Moderate because exploitation requires adjacent proximity or local interaction to initiate a Bluetooth Secure Simple Pairing transaction, and standard Red Hat Enterprise Linux server deployments do not enable or attach Bluetooth hardware by default. On hosts equipped with an active Bluetooth interface, concurrent connection release during passkey processing can trigger memory corruption, potentially leading to a kernel crash or privilege escalation. Systems operating without Bluetooth adapters or with the subsystem disabled are not exposed to this issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.