Technical Summary

The Linux kernel Bluetooth subsystem had a concurrency vulnerability due to unsynchronized access to the accept queue in the bt_sock_poll() function. This allowed a race condition where the accept queue could be traversed while a child socket was being torn down, potentially leading to use-after-free or reference counting errors. The vulnerability has been present since the Bluetooth code was first imported into the kernel. The patch introduces a dedicated lock to serialize access to the accept queue and modifies bt_accept_dequeue() to take temporary references under the queue lock before releasing it and locking the child socket, thus preventing unsafe concurrent modifications.