A memory leak and potential use-after-free vulnerability in the Linux kernel Bluetooth subsystem poses a high risk of system instability or unauthorized code execution for adjacent attackers.

The vulnerability exists in the Bluetooth hci_conn component where incorrect lifecycle management of SCO setup contexts can lead to memory leaks or use-after-free conditions. This flaw is reachable by an unauthenticated attacker within Bluetooth range, as the kernel fails to properly clean up pending synchronization tasks when connections are cancelled or unregistered.

The vulnerability carries a CVSS score of 8.8, reflecting its high impact on system integrity, confidentiality, and availability. Successful exploitation could allow an attacker to crash the system (denial of service) or potentially execute arbitrary code with kernel-level privileges, leading to a complete compromise of the affected host. Given that this affects the Bluetooth stack, devices in public or office environments are at elevated risk.

Immediate Action: Update the Linux kernel to version 6.1.188, 6.6.157, 6.12.110, 6.18.52, or newer, depending on your current distribution branch. Ensure that security patches are applied and the system is rebooted to load the corrected kernel modules.

Proactive Monitoring: Monitor system logs for kernel panics or unexpected Bluetooth subsystem errors that may indicate exploitation attempts. Review dmesg outputs for memory allocation failures or suspicious Bluetooth connection behavior.

Compensating Controls: Disable the Bluetooth service on systems where wireless connectivity is not strictly required to eliminate the attack surface. If Bluetooth is necessary, restrict physical access to the environment to prevent proximity-based attacks.

Public Exploit Available: No

This vulnerability represents a significant risk to kernel stability and system security. IT administrators should prioritize the deployment of patched kernel versions as part of their regular patch management cycle. Given the nature of kernel-level flaws, testing updates in a staging environment before broad production deployment is advised to prevent potential service interruptions.