A stack-based out-of-bounds write vulnerability in the Linux Bluetooth driver could allow a local attacker to escalate privileges or crash the system.

The vulnerability is located in the eir_create_adv_data() function within the Bluetooth subsystem. It is a stack-based out-of-bounds write that can be triggered by a local attacker with CAP_NET_ADMIN privileges, allowing them to corrupt memory and potentially execute arbitrary code.

The vulnerability carries a high CVSS score of 7.8, reflecting the potential for local privilege escalation and system denial of service. While it requires specific privileges to exploit, successful execution could result in full system compromise, representing a significant risk to security in environments where local access is shared.

Immediate Action: Update the Linux kernel to version 6.1.178, 6.12.97, 6.18.40, 7.1.5, or newer.

Proactive Monitoring: Review system logs for Bluetooth service errors or unusual kernel activity related to network stack operations.

Compensating Controls: Restrict CAP_NET_ADMIN capabilities to authorized users and services to minimize the potential for exploitation.

Public Exploit Available: false

Kernel vulnerabilities of this nature are high-priority items. Administrators should schedule and perform updates to the latest stable kernel versions to ensure that memory safety issues in the Bluetooth subsystem are addressed, thereby preventing local privilege escalation.