The Linux kernel Bluetooth hci_qca driver contains a critical use-after-free vulnerability that could allow an adjacent attacker to achieve code execution or system instability.

This vulnerability occurs in the qca_controller_memdump function, where an invalid dump size triggers an error path that fails to clear the memdump state. This results in a use-after-free condition where subsequent operations access freed memory, and it is reachable by an unauthenticated attacker via an adjacent network connection.

A successful exploit could allow an attacker to compromise the integrity and availability of the affected system. Given the CVSS score of 8.8, this flaw poses a significant risk of remote code execution, potentially leading to full system compromise or persistent denial of service conditions.

Immediate Action: Update the Linux kernel to version 6.6.148, 6.12.101, 6.18.42, 7.1.6, or later to incorporate the necessary memory management fixes.

Proactive Monitoring: Monitor system logs for kernel panics or unexpected Bluetooth driver restarts that may indicate exploitation attempts.

Compensating Controls: If patching is not immediately feasible, disable the Bluetooth subsystem if it is not required for production operations to eliminate the attack surface.

Public Exploit Available: Unknown.

This vulnerability represents a significant risk to systems utilizing the hci_qca Bluetooth driver. Organizations should prioritize patching their kernel environments as soon as stable updates are verified and deployed in their testing pipelines to prevent potential exploitation of this use-after-free condition.