A race condition vulnerability in the Linux kernel Bluetooth SCO subsystem allows local authenticated attackers to achieve arbitrary code execution or system compromise.

This is a race condition resulting from missing socket lock validation during connect operations in the Bluetooth SCO subsystem, allowing a low-privileged local user to trigger memory corruption via concurrent system calls.

A successful exploit of this vulnerability can lead to complete system compromise, including privilege escalation, data theft, and denial of service. The CVSS score of 7.8 indicates a high severity threat, primarily constrained by the requirement for local access, though the potential impact on system integrity and confidentiality is severe.

Immediate Action: Update the Linux kernel to version 6.1.168, 6.6.134, 6.12.81, or later depending on the active release branch.

Proactive Monitoring: Monitor system logs for unexpected kernel panics, segmentation faults, or anomalies related to Bluetooth subsystem activities.

Compensating Controls: Restrict local shell access and limit user privileges to minimize the risk of unauthorized local execution.

Public Exploit Available: false

Organizations running affected Linux kernel versions should prioritize applying the vendor provided security updates promptly. Securing local environments and ensuring that kernel packages are updated to the fixed releases is essential to mitigate the risk of local privilege escalation and system instability.