CVE-2026-64406

A flaw was found in the Linux kernel's Bluetooth subsystem. This use-after-free (UAF) vulnerability in the bt_accept_dequeue() function occurs because a temporary reference is prematurely dropped, leading to sock_hold() accessing freed memory. An attacker could potentially exploit this to cause a denial of service (DoS) or other unpredictable system behavior.

This vulnerability is rated as Moderate impact because exploiting it requires local execution privileges to manipulate listening Bluetooth sockets, confining the blast radius to a kernel panic and denial of service. Standard Red Hat Enterprise Linux server environments typically disable or do not deploy Bluetooth hardware and associated services, substantially restricting default exposure. Systems operating without active Bluetooth interfaces or listening sockets remain unaffected by this flaw during standard operations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.