A race condition in the Linux kernel Bluetooth RFCOMM subsystem could allow an adjacent attacker to trigger a use-after-free vulnerability, posing a high risk of system compromise.

The vulnerability exists due to improper serialization in the rfcomm_security_cfm function. An unauthenticated adjacent attacker can exploit this race condition between the RFCOMM session teardown and security confirmation handling to access freed memory, resulting in a use-after-free condition.

Successful exploitation of this vulnerability can lead to memory corruption, which may result in a kernel panic causing system denial of service, or potentially allow an attacker to achieve arbitrary code execution. Given the CVSS score of 8.8, this flaw represents a significant risk to the integrity and availability of affected systems. Organizations relying on Bluetooth-enabled Linux infrastructure should prioritize remediation to prevent unauthorized system access or service disruptions.

Immediate Action: Update the Linux kernel to version 6.12.109, 6.18.50, 7.2.4, or later as provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for unexpected kernel crashes or KASAN reports that may indicate exploitation attempts targeting Bluetooth stack memory.

Compensating Controls: If patching is not immediately feasible, disable the Bluetooth service on affected devices to remove the attack vector entirely.

Public Exploit Available: Unknown

This vulnerability presents a serious risk to Linux-based systems utilizing Bluetooth connectivity. Given the potential for kernel-level memory corruption and arbitrary code execution, administrators should prioritize the deployment of the provided kernel patches. Immediate application of these updates is the most effective way to eliminate the underlying race condition and secure the environment against potential exploitation.