CVE-2026-52918

A flaw was found in the Linux kernel's Bluetooth subsystem. A race condition exists in the handling of the accept_q within the bt_sock_poll() function due to a lack of synchronization. This could allow a local attacker to cause a denial of service by manipulating socket operations during child teardown, leading to system instability.

A race in Bluetooth accept queue handling can allow bt_sock_poll() or the accept dequeue path to observe a child socket while teardown concurrently unlinks it and drops the last reference. This is a use-after-free candidate in kernel socket lifetime management and can cause at least a kernel crash. For the CVSS the PR:N is used for the paranoid adjacent scenario because an attacker may only need Bluetooth radio adjacency to interact with a listening Bluetooth service and force child connection teardown while the service polls the accept queue. The issue is not Internet reachable in the usual sense and normally requires local Bluetooth availability or proximity to the target device. Impact is at least denial of service and in the worst case may allow confidentiality or integrity impact due to kernel use-after-free behavior.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.