A Use-After-Free vulnerability in the Bluetooth bnep driver allows an adjacent attacker to potentially execute arbitrary code or cause a system crash.

The bnep_add_connection function fails to properly hold the bnep_session_sem semaphore while accessing device names. An unauthenticated attacker within Bluetooth range can trigger a race condition that frees the net_device, resulting in a use-after-free scenario.

An attacker in proximity to the target system can exploit this vulnerability to crash the kernel or gain elevated privileges. Given the CVSS score of 8.8, this presents a significant risk to mobile devices, workstations, and IoT hardware that utilize Bluetooth networking, potentially leading to total system compromise.

Immediate Action: Update the Linux kernel to version 5.10.258, 5.15.209, 6.1.175, or later.

Proactive Monitoring: Review Bluetooth connection logs for unusual activity or frequent interface resets, which may indicate exploitation attempts.

Compensating Controls: Disable Bluetooth interfaces on critical systems where wireless connectivity is not required to eliminate the attack vector.

Public Exploit Available: Unknown

This vulnerability poses a high risk to systems with active Bluetooth capabilities. System administrators should prioritize applying kernel security patches, particularly on devices that are frequently exposed to public or untrusted wireless environments.