CVE-2026-52918: Linux Kernel Bluetooth Socket Race Condition (CVSS 8.8)

Technical summary

CVE-2026-52918 is a use-after-free vulnerability in the Linux kernel's Bluetooth socket layer. The vulnerability stems from an unsynchronized access pattern in bt_sock_poll(), which iterates over the accept_q queue without holding a lock, while concurrent socket teardown can unlink and dereference entries in that queue. The fix introduces a dedicated lock to serialize all accept_q modifications and polling operations, and refactors bt_accept_dequeue() to acquire temporary child references under the queue lock before releasing it to perform per-socket operations. This prevents the window in which a freed socket can be accessed during queue traversal.

Business impact

Exploitation could lead to kernel crashes, system hangs, or memory corruption in systems with Bluetooth connectivity enabled. On servers, containers, or IoT devices relying on Bluetooth for device pairing, authentication, or communication, a crash represents denial of service. In worst-case scenarios, memory corruption could enable privilege escalation or code execution, though the attack requires local network proximity (Bluetooth range) and no user interaction. Organizations running unpatched Linux systems with Bluetooth active should assess exposure.

Affected systems

The Linux kernel across all maintained versions and distributions is affected. Systems with Bluetooth support compiled in or loaded as a module are at risk; however, the vulnerability requires local Bluetooth network adjacency to trigger. Affected endpoints include laptops, desktops, servers, embedded devices, and containers that have Bluetooth enabled. Systems running the kernel without Bluetooth functionality are not affected.

Exploitability

Exploitation requires local Bluetooth network proximity and crafted connection requests to trigger the race condition. The attack vector is Adjacent (AV:A), meaning an attacker must be within Bluetooth range. No privileges or user interaction are required. The race condition window is narrow but reproducible under stress. This is not remotely exploitable over the internet but poses a meaningful risk in environments where Bluetooth is active and untrusted devices are nearby.

Remediation

Apply the kernel patch that introduces the dedicated accept_q lock and refactors bt_accept_dequeue(). Patched versions of major distributions will be released through standard update channels. Organizations should enable Bluetooth only when needed and disable it on systems not requiring the functionality. For endpoints in security-sensitive environments, disabling Bluetooth or blocking it at the device level (BIOS/UEFI, or OS policy) is the most effective interim control.

Patch guidance

Monitor your Linux distribution's security advisories and release notes for updated kernel versions addressing CVE-2026-52918. Major distributions (Red Hat, Ubuntu, Debian, SUSE) will backport this fix to their maintained kernel series. Apply patches promptly to systems with Bluetooth enabled. Verify patch deployment through kernel version checks and confirm Bluetooth functionality remains intact post-update. If you use containers, update base images and ensure host kernels are patched to address the host-level vulnerability.

Detection guidance

Monitor kernel logs and syslog for Bluetooth-related oops, BUG_ON triggers, or general protection faults (GPF) in bt_sock_poll() or related Bluetooth socket functions. Tools like 'dmesg', audit logs, and kernel crash dumps may reveal exploitation attempts. Network-based detection is difficult due to the local nature of the attack; focus on anomaly detection (unexpected system reboots, Bluetooth service crashes) on endpoints with Bluetooth active. Organizations running security kernels (audit, SELinux, AppArmor) may capture additional forensic signals.

Why prioritize this

This vulnerability scores CVSS 8.8 (HIGH) due to its potential for system compromise via memory corruption, the ease of triggering the race condition once Bluetooth is active, and the absence of privilege or user interaction barriers. The presence of the bug across all kernel versions and the widespread enablement of Bluetooth on consumer and enterprise devices elevates risk. Organizations should prioritize patching systems where Bluetooth is enabled and in proximity to untrusted networks (offices, public spaces, vehicles).

Risk score, explained

The CVSS:3.1 vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H yields 8.8 because: local Bluetooth adjacency (AV:A) is a readily achievable precondition; low complexity (AC:L) means the race condition is straightforward to induce; no privileges or user interaction are required (PR:N, UI:N); confidentiality, integrity, and availability are all fully compromised (C:H, I:H, A:H) upon successful exploitation. The vulnerability does not cross scope boundaries but affects the entire system's Bluetooth subsystem.

Frequently asked questions