CVE-2026-98246

A flaw was found in the Linux kernel's Bluetooth subsystem. A race condition during Bluetooth device closure allows codec list cleanup to proceed without appropriate locking while a concurrent socket option query is reading codec entries. A local user can exploit this vulnerability to trigger a use-after-free condition, leading to a Denial of Service (DoS) via a system crash or potential privilege escalation.

This vulnerability is rated as Moderate severity because exploitation requires local access, specific timing to win a narrow race condition, and the presence of active Bluetooth hardware on the host. In typical Red Hat Enterprise Linux server and cloud deployments, Bluetooth controllers and services are either not present or disabled, significantly mitigating real-world exposure. Furthermore, triggering the flaw requires a local process to issue socket option queries simultaneously while the Bluetooth interface is being brought down.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.