A use-after-free vulnerability in the Linux kernel Bluetooth subsystem poses a high risk of system instability or potential code execution for attackers with local, low-privileged access.

The vulnerability resides in the bt_accept_dequeue function, where a temporary reference is dropped prematurely before the accept queue lock is released. This flaw allows a use-after-free condition when the final reference to a socket is accessed during listening L2CAP socket cleanup.

Successful exploitation of this vulnerability can lead to kernel panic, resulting in system denial of service. While the CVSS score of 8.0 reflects a high-severity impact, the requirement for an adjacent network vector and low-privileged access limits the immediate threat surface to users already present within the local or adjacent network environment.

Immediate Action: Update the Linux kernel to the latest stable release, specifically versions 5.10.261, 5.15.212, 6.1.178, 6.6.145, or newer, as provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for kernel oops or segmentation faults related to the Bluetooth stack, particularly following high-frequency connection or disconnection events.

Compensating Controls: If patching is not immediately feasible, disable the Bluetooth service or blacklist the affected kernel modules (such as btusb or l2cap) to neutralize the attack vector.

Public Exploit Available: Unknown

Given the high CVSS score and the critical nature of the Linux kernel, organizations should prioritize patching affected systems. Administrators must verify kernel versions across their fleet and apply the upstream stable fixes to ensure system stability and mitigate potential local exploitation risks.