Linux Kernel CVE-2026-52918

Vendor-released patch: upgrade to a fixed stable kernel - 5.10.259, 5.15.210, 6.1.176, 6.6.142, 6.12.92, 6.18.34, or mainline 7.1 (or later) - matching your maintained branch; the fix adds a dedicated lock serializing accept_q updates and polling and takes temporary child references before locking the child socket (see the git.kernel.org/stable/c/ commits, e.g. d9ce4de05df2 and 41c8c1c7923e). Apply your distribution's corresponding patched kernel package, since most enterprises consume backported stable fixes rather than building mainline. If immediate patching is not possible, the most direct compensating control is to reduce exposure of the vulnerable code path: disable or unload the Bluetooth stack (e.g. blacklist the bluetooth/bnep/rfcomm/l2cap modules or disable the Bluetooth service) on systems that do not require it, which fully removes the attack surface at the cost of losing Bluetooth functionality; on systems that need Bluetooth, restrict which local users/processes can open Bluetooth sockets and avoid running untrusted local code, since the race requires concurrent local socket operations. Advisory references: https://nvd.nist.gov/vuln/detail/CVE-2026-52918 and https://vuldb.com/vuln/373156.