CVE-2026-53292

A flaw was found in the Linux kernel's phonet networking subsystem. A local user could trigger a kernel panic by sending a specially crafted message, leading to a denial of service. This occurs because the pn_socket_autobind() function incorrectly assumes a socket is already bound when pn_socket_bind() returns an -EINVAL error, causing a BUG_ON() assertion to fire.

Red Hat rates the security impact of this vulnerability as Moderate because exploitation requires local access and can only trigger a system denial of service, without risk to data confidentiality or integrity. The condition occurs when socket transmission triggers an assertion failure within the phonet protocol handling routines. Phonet is a legacy cellular communications stack not utilized in standard enterprise deployments, and supported Red Hat Enterprise Linux releases do not include the vulnerable code.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.