Junglewise Threat Intelligence

CVE-2026-52918: Linux Kernel race condition in Bluetooth accept queue

CVE-2026-52918 · Severity: info · CVSS 0 · Published 2026-06-24

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability was identified in the Linux kernel's Bluetooth subsystem where certain internal connection queues were not properly synchronized. This could allow a local attacker or a nearby device to cause a system crash or potentially execute unauthorized actions by triggering a race condition during connection setup or teardown. The issue has been present since the early versions of the Bluetooth implementation in Linux.

Technical details

A race condition exists in the Linux kernel Bluetooth implementation (af_bluetooth.c) due to lack of synchronization when walking the accept_q in bt_sock_poll(). While the queue is being traversed, a concurrent child socket teardown can unlink the socket and drop its final reference, leading to a use-after-free or null pointer dereference. The fix introduces a dedicated spinlock (accept_q_lock) to serialize access to the queue and reworks bt_accept_dequeue() to safely manage socket reference counts under the lock. This vulnerability affects systems using Bluetooth from version 2.6.12 up to various stable branches fixed in June 2026.

Affected products

  • Linux Linux Kernel 2.6.12 through 6.13.y

Timeline

  • 2026-05-29: other: Patch submitted by developer
  • 2026-06-19: patched: Patch committed to stable tree
  • 2026-06-24: disclosed: CVE published

References

Related threats