CVE-2026-52918 Bluetooth: serialize accept_q access
A race condition in the Linux kernel Bluetooth subsystem allows attackers to cause a denial of service via unsynchronized access to the accept queue.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-52918?
CVE-2026-52918 is a high-severity vulnerability in Linux kernel, published on 24 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: serialize accept_q access
bt_sock_poll() walks the accept queue without synchronization, while child teardown can unlink the same socket and drop its last reference. The unsynchronized accept queue walk has existed since the initial Bluetooth import.
Protect accept_q with a dedicated lock for queue updates and polling. Also rework bt_accept_dequeue() to take temporary child references under the queue lock before dropping it and locking the child socket.
Weakness: CWE-362
Which versions are affected by CVE-2026-52918?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-52918?
Apply the vendor's patch.
Is CVE-2026-52918 being exploited?
There is no known exploitation of CVE-2026-52918 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-90632, BELL-CVE-2026-52918, DEBIAN-CVE-2026-52918, GHSA-rf7j-4mgx-52c3, ROOT-OS-DEBIAN-11-CVE-2026-52918, ROOT-OS-DEBIAN-12-CVE-2026-52918 and 3 more.