A deadlock condition in the Linux kernel Bluetooth subsystem could allow an unauthenticated attacker to cause a denial-of-service by hanging the affected system.

The vulnerability resides in the iso_sock_timeout function, which incorrectly attempts to disable a timer while holding the lock_sock lock. An unauthenticated attacker within proximity can force this condition, resulting in a deadlock that renders the affected system unresponsive.

With a CVSS score of 8.8, this vulnerability poses a high risk to availability. Successful exploitation results in a denial-of-service, which can disrupt critical services relying on the Linux kernel, leading to operational downtime and potential loss of data in flight.

Immediate Action: Update the Linux kernel to version 6.12.103, 6.18.44, 7.1.8, or later versions.

Proactive Monitoring: Monitor system logs for kernel panics or hang events related to the Bluetooth stack.

Compensating Controls: Restrict physical or proximity-based access to Bluetooth-enabled hardware to reduce the attack surface.

Public Exploit Available: No (exploit_available: false)

Immediate patching is recommended to maintain system availability. Organizations should verify that kernel updates include these specific Bluetooth fixes to ensure protection against this denial-of-service vector.