CVE-2026-98632

A flaw was found in the Linux kernel's Bluetooth subsystem. A local attacker can trigger a use-after-free condition by cancelling a pending Bluetooth mesh transmission while it remains queued for processing. When the system later attempts to handle the queued transmission using the already freed object, memory corruption occurs, which can lead to a Denial of Service (DoS) through a system crash or potential privilege escalation.

This vulnerability is rated as Moderate impact for Red Hat Enterprise Linux because exploitation requires a local user with administrative privileges (such as CAP_NET_ADMIN) and access to the Bluetooth management socket. Furthermore, successfully triggering this race condition depends on canceling queued Bluetooth mesh traffic on systems equipped with active Bluetooth hardware. In standard enterprise server and cloud deployments, Bluetooth interfaces are generally absent or inactive, substantially limiting exposure in typical production environments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.