A use-after-free vulnerability in the Linux kernel Bluetooth SCO implementation allows an adjacent attacker to potentially trigger memory corruption or system instability.

The vulnerability is a use-after-free flaw occurring in the Bluetooth Synchronous Connection-Oriented (SCO) socket logic. It is caused by an improper reference counting mechanism where the socket fails to maintain its own reference to the connection, allowing an unauthenticated adjacent attacker to trigger a race condition during disconnection events.

Successful exploitation of this vulnerability could lead to a system crash or potentially arbitrary code execution within the kernel context. Given the CVSS score of 8.8, this flaw represents a significant risk to system availability and integrity, as it allows attackers on the adjacent network segment to influence kernel memory operations.

Immediate Action: Update the Linux kernel to version 6.18.44, 7.1.8, or later, as these versions incorporate the necessary reference counting fixes.

Proactive Monitoring: Monitor system logs for kernel oops or crash reports specifically related to Bluetooth stack activity or slab-use-after-free errors.

Compensating Controls: Disable the Bluetooth subsystem if it is not required for system operations to eliminate the attack surface entirely.

Public Exploit Available: No

This vulnerability presents a high risk to Linux systems utilizing Bluetooth connectivity. Administrators should prioritize patching the kernel to the specified versions to ensure the Bluetooth stack reference counting is handled correctly and to prevent potential memory corruption attacks.