A critical race condition vulnerability in the Linux kernel Bluetooth subsystem poses a significant risk of unauthorized access or system instability to affected systems.

The vulnerability exists within the hci_sync component of the Bluetooth subsystem, where the system fails to hold the hdev lock during hci_conn_params lookups. This concurrency flaw allows an unauthenticated attacker within proximity to the target device to potentially corrupt memory or cause a denial of service.

The exploitation of this flaw could lead to full system compromise or service disruption, severely impacting operational continuity. With a CVSS score of 8.8, this high-severity vulnerability indicates a substantial risk to confidentiality, integrity, and availability for any environment utilizing Bluetooth-enabled Linux systems, such as industrial controllers or mobile infrastructure.

Immediate Action: Update the Linux kernel to version 7.1.6 or later to ensure the necessary locking mechanisms are correctly implemented.

Proactive Monitoring: Monitor Bluetooth traffic for unusual connection patterns and review system logs for kernel panics or unexpected service restarts related to the Bluetooth stack.

Compensating Controls: If patching is not immediately feasible, disable the Bluetooth service on affected systems to eliminate the attack vector entirely.

Public Exploit Available: No (exploit_available: false)

Given the high CVSS score and the critical nature of the affected component, organizations should prioritize the deployment of the upstream kernel patch. Failure to address this flaw could provide a pathway for attackers to gain elevated control over affected hardware. Administrators are urged to verify their current kernel versions and schedule maintenance windows for immediate remediation.