A high-severity race condition in the Linux kernel Bluetooth subsystem allows local authenticated attackers to achieve arbitrary code execution or system compromise.

This flaw is a race condition resulting from improper locking within the Bluetooth ISO socket cleanup routines, allowing low-privileged local users to trigger a use-after-free or null pointer dereference condition.

Successful exploitation of this vulnerability can lead to a complete compromise of the affected host, including arbitrary code execution, privilege escalation, or kernel panics resulting in denial of service. While the attack vector requires local access and low privileges, the CVSS score of 7.8 reflects the severe impact of potential full system ownership and destabilization of critical infrastructure servers.

Immediate Action: Update the Linux kernel to version 6.1.176, 6.6.143, 6.12.93, 6.18.35, or later, where the socket serialization locking issue is resolved.

Proactive Monitoring: Monitor system logs for kernel panics, segmentation faults, or unauthorized local execution attempts, particularly involving Bluetooth daemon processes.

Compensating Controls: Restrict local shell access and disable unused Bluetooth kernel modules (such as btusb and bluetooth) on servers where wireless capabilities are unnecessary.

Public Exploit Available: false

Administrators managing systems utilizing Linux kernel Bluetooth functionality must prioritize applying the latest stable kernel updates. Restricting local user access and hardening host systems will further mitigate the risk of exploitation while patch deployment is underway.