Executive brief
A vulnerability was identified in the Linux kernel's Bluetooth subsystem where certain internal connection queues were not properly synchronized. This could allow a local attacker or a nearby device to cause a system crash or potentially execute unauthorized actions by triggering a race condition during connection setup or teardown. The issue has been present since the early versions of the Bluetooth implementation in Linux.
Technical details
A race condition exists in the Linux kernel Bluetooth implementation (af_bluetooth.c) due to lack of synchronization when walking the accept_q in bt_sock_poll(). While the queue is being traversed, a concurrent child socket teardown can unlink the socket and drop its final reference, leading to a use-after-free or null pointer dereference. The fix introduces a dedicated spinlock (accept_q_lock) to serialize access to the queue and reworks bt_accept_dequeue() to safely manage socket reference counts under the lock. This vulnerability affects systems using Bluetooth from version 2.6.12 up to various stable branches fixed in June 2026.
Affected products
- Linux Linux Kernel 2.6.12 through 6.13.y
Timeline
- 2026-05-29: other: Patch submitted by developer
- 2026-06-19: patched: Patch committed to stable tree
- 2026-06-24: disclosed: CVE published
References
- https://git.kernel.org/stable/c/41c8c1c7923e86e0eb59cfb4279349112756a336
- https://git.kernel.org/stable/c/4ec17782fd186f901a7329605d11048b085b945a
- https://git.kernel.org/stable/c/85f8674cae82053f1e6bab295f6a8422cca14db5
- https://git.kernel.org/stable/c/8b4c412e001b0c670eb937beab491af974da55b3
- https://git.kernel.org/stable/c/a218bf69eb51fefe59a3976fa8925261141f681c
- https://git.kernel.org/stable/c/be43e6b4043113c3b3cf887c3c8350f67140274c
- https://git.kernel.org/stable/c/d9ce4de05df2385c19e2c7d12f529144e1a44af1