A race condition within the Linux kernel Bluetooth L2CAP subsystem presents a high-severity risk that could allow an authenticated local attacker to achieve code execution or system compromise.

This is a race condition vulnerability (CWE-362) occurring in the l2cap_sock_cleanup_listen function. An attacker with low-level privileges on the local system can trigger an unsafe lockless read of the L2CAP channel, leading to potential memory corruption when concurrent socket cleanup operations occur.

Successful exploitation of this flaw could allow an attacker to gain elevated privileges or cause a kernel panic, resulting in unauthorized access to sensitive data or denial of service for critical infrastructure. While the CVSS score of 8.0 reflects a high severity, the requirement for local access necessitates internal security controls to prevent lateral movement and privilege escalation by malicious actors.

Immediate Action: Update the Linux kernel to version 6.1.188, 6.6.157, 6.12.110, 6.18.52, or later as appropriate for your distribution.

Proactive Monitoring: Monitor system logs for kernel oops or unexpected system reboots associated with Bluetooth service activity.

Compensating Controls: If patching is not immediately feasible, disable the Bluetooth service on high-security servers where wireless connectivity is not required to eliminate the attack surface.

Public Exploit Available: Unknown

Given the potential for privilege escalation, administrators should prioritize applying the provided kernel patches across all affected Linux environments. Ensure that standard patch management cycles are accelerated for systems that expose Bluetooth functionality to untrusted users.