A high-severity race condition in the Linux kernel Bluetooth ISO implementation could result in memory corruption and unauthorized system impact.

This is a race condition involving kfree and kref_get_unless_zero operations. The vulnerability occurs because the iso_data member of the hci_conn structure is accessed and modified without appropriate lock or RCU protection, allowing an unauthenticated attacker to trigger the race.

The vulnerability is rated at 8.8 on the CVSS scale. Successful exploitation can lead to memory corruption, resulting in service disruption or elevated system access, which poses a severe risk to the confidentiality and availability of the affected system.

Immediate Action: Update the Linux kernel to version 7.1.8 or later, or apply the upstream commits 876a3e94c70d0859d1dad1c986112d4f0d99eba8 or af24e338bf5dafb80f42baa9a0b9e9b57b1c5d9c.

Proactive Monitoring: Utilize kernel introspection tools to detect memory management anomalies or unexpected crashes in the Bluetooth stack.

Compensating Controls: Disable Bluetooth functionality at the system level if the feature is not strictly required for business operations.

Public Exploit Available: No

Security teams must prioritize the deployment of the provided kernel fixes. Given the nature of race condition vulnerabilities, kernel updates are the only reliable way to ensure the memory safety of the Bluetooth ISO implementation.