A use-after-free vulnerability in the Linux kernel Bluetooth subsystem allows unauthenticated adjacent attackers to achieve high impact across confidentiality, integrity, and availability.

This is a use-after-free vulnerability within the Bluetooth hci_event handler, specifically in the hci_le_remote_conn_param_req_evt function, requiring no authentication from an adjacent network attacker.

The exploitation of this flaw can lead to complete system compromise, arbitrary code execution, or kernel panics causing denial of service. Because the CVSS score is 8.8, this vulnerability represents a high-severity risk that threatens the operational stability and data security of affected systems.

Immediate Action: Update the Linux kernel to version 6.1.168, 6.6.134, 6.12.81, 6.18.22, or later where the critical section lock extension has been applied.

Proactive Monitoring: Monitor system logs for kernel panics, segmentation faults, or unexpected Bluetooth subsystem restarts that may indicate exploitation attempts.

Compensating Controls: Restrict physical and adjacent network access to Bluetooth interfaces where possible if immediate kernel updates cannot be performed.

Public Exploit Available: false

Given the critical nature of kernel-level use-after-free flaws, system administrators must prioritize applying the latest stable kernel updates. Immediate patching is vital to prevent potential arbitrary code execution and system crashes originating from the vulnerable Bluetooth subsystem.