A high-severity use-after-free vulnerability in the Linux kernel Bluetooth subsystem poses a significant risk of system instability or unauthorized code execution.

This is a use-after-free (UAF) flaw occurring within the hci_connect_big_sync callback. An unauthenticated attacker within proximity can trigger this race condition if a connection object is freed while the hci_sync task is actively processing.

The vulnerability carries a CVSS score of 8.8, indicating a high risk to system integrity and availability. Successful exploitation could lead to kernel-level crashes, system denial of service, or potentially arbitrary code execution, resulting in full compromise of the affected host.

Immediate Action: Update the Linux kernel to version 7.1.8 or later, or apply the relevant stable branch patches (2d91e6244b69d752503b2d44020d8b0e323dbd38 or 56e78b670356caab0b607e8aad4cf819a1909d07).

Proactive Monitoring: Monitor system logs for kernel oops or panic events specifically related to Bluetooth stack activity.

Compensating Controls: If patching is not immediately feasible, disable the Bluetooth service on high-risk or exposed systems to eliminate the attack surface.

Public Exploit Available: No

Given the potential for kernel-level impact, administrators should prioritize updating kernel packages across all affected Linux distributions. Testing patches in a staging environment is advised before production deployment to ensure stability.