A critical use-after-free vulnerability in the Linux kernel Bluetooth stack allows an adjacent attacker to potentially execute arbitrary code or cause a kernel panic.

The hci_find_adv_instance function returns a pointer to advertising data that is only valid while the hdev lock is held, leading to a UAF condition if accessed subsequently. The attacker is unauthenticated.

This vulnerability poses a severe risk to system stability and security. With a CVSS score of 8.8, exploitation could result in full system compromise, allowing an attacker to bypass security controls or crash the host system.

Immediate Action: Apply the latest security patches provided by your Linux distribution, ensuring the kernel is updated to at least 6.12.103, 6.18.44, or 7.1.8.

Proactive Monitoring: Review system logs for memory-related errors or kernel panics related to the Bluetooth stack.

Compensating Controls: If patching is delayed, restrict Bluetooth connectivity to trusted devices and disable the Bluetooth service where possible.

Public Exploit Available: No

Given the potential for kernel-level memory corruption, it is imperative that organizations patch their Linux infrastructure immediately. Priority should be given to systems where Bluetooth is enabled and exposed to untrusted environments.