A use-after-free vulnerability in the Linux kernel Bluetooth L2CAP subsystem affects the Linux kernel and can lead to remote code execution or system instability.

This is a use-after-free flaw residing in the Bluetooth L2CAP channel timeout handler, triggered when a connection is torn down while a timeout worker is active without proper reference counting, requiring zero privileges from an adjacent network attacker.

A successful exploit can result in complete system compromise, enabling arbitrary code execution, denial of service, or unauthorized data access within the kernel space. Given the high CVSS score of 8.8, this vulnerability poses an acute risk to operational stability and confidentiality on any host utilizing vulnerable Bluetooth configurations.

Immediate Action: Update the Linux kernel to version 5.10.265, 5.15.216, 6.1.183, 6.6.145, or later where the connection reference counting fix is applied.

Proactive Monitoring: Monitor system logs for kernel panics, slab use-after-free bug traces related to l2cap_chan_timeout, or unexpected Bluetooth connection drops.

Compensating Controls: Disable the Bluetooth subsystem on servers and systems where wireless peripheral connectivity is unnecessary to eliminate the attack surface entirely.

Public Exploit Available: false

Administrators must prioritize updating affected Linux kernel packages immediately to prevent potential kernel-level exploitation via the Bluetooth stack. Testing and deploying the upstream patches across all active kernel branches is essential for maintaining robust infrastructure security.