A high-severity use-after-free vulnerability in the Linux kernel Bluetooth subsystem poses a significant risk of system crashes or arbitrary code execution.

The vulnerability exists in the iso_conn_ready function, where a race condition allows a listener socket to be freed while it is still being referenced by a child socket. This occurs when a listener socket is closed concurrently with connection setup, resulting in a use-after-free scenario that an unauthenticated attacker can trigger over a local radio frequency (Adjacent network vector).

Successful exploitation of this vulnerability can lead to a kernel panic, resulting in system instability and denial of service. Furthermore, use-after-free flaws in the kernel often provide a pathway for local or adjacent attackers to achieve privilege escalation or arbitrary code execution. With a CVSS score of 8.8, this flaw represents a significant threat to the integrity and availability of systems utilizing Bluetooth connectivity.

Immediate Action: Apply the vendor-provided security patches by updating the Linux kernel to version 6.12.109, 6.18.50, 7.2.4, or later versions where the fix has been backported.

Proactive Monitoring: Monitor system logs for kernel oops or unexpected service crashes associated with the Bluetooth stack.

Compensating Controls: If patching is not immediately feasible, disable the Bluetooth service on high-risk or exposed systems to eliminate the attack surface.

Public Exploit Available: Unknown

The Linux kernel Bluetooth subsystem is a critical component that frequently handles unauthenticated traffic, making this vulnerability a high priority for remediation. Administrators should prioritize the deployment of the identified stable kernel updates across all affected infrastructure to mitigate the risk of memory corruption and potential system compromise.