A use-after-free vulnerability in the Linux kernel Bluetooth subsystem allows local authenticated attackers to achieve arbitrary code execution or system instability.

This is a use-after-free vulnerability located within the Bluetooth hci_conn component, specifically in the set_cig_params_sync function, requiring local low-privilege attacker interaction.

A successful exploit could allow a malicious local user to compromise the operating system kernel, leading to potential privilege escalation, data compromise, or denial of service through kernel panic. The CVSS score of 7.8 reflects a high severity rating primarily due to the potential for complete system compromise despite requiring local access and low privileges.

Immediate Action: Update the Linux kernel to version 6.6.143, 6.12.81, 6.18.22, 6.19.12, or later where the missing lock coverage is applied.

Proactive Monitoring: Monitor system logs for unexpected kernel panics, segmentation faults, or unusual kernel module activity associated with the Bluetooth subsystem.

Compensating Controls: Restrict local shell access and disable unused Bluetooth adapters on sensitive or high-risk hosts to reduce the local attack surface.

Public Exploit Available: false

Security teams must prioritize patching affected Linux kernel instances to mitigate the risk of local kernel exploitation. System administrators should schedule kernel updates during the next maintenance window or apply hotpatches if supported by their distribution.