CVE-2026-93247

A flaw was found in the Linux kernel's Bluetooth subsystem. A local attacker can cause a Denial of Service (DoS) due to a race condition in the service discovery management code. Under specific timing conditions, clearing discovery filters concurrently with starting service discovery leaves internal device state unsynchronized. When incoming Bluetooth advertising reports are subsequently processed against this inconsistent state, a null pointer dereference occurs, resulting in a kernel crash.

This vulnerability is rated as Moderate impact because successful exploitation requires local user privileges, an active Bluetooth controller, and specific race timing to trigger a kernel panic and denial of service. Default enterprise deployments on server, virtualized, and cloud infrastructure typically lack physical Bluetooth adapters or operate with Bluetooth services inactive, which limits exposure. Exploitation leads solely to system unavailability through an unhandled null pointer dereference without risking data confidentiality or integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.