Linux Kernel Bluetooth Subsystem Use-After-Free Vulnerability

A use-after-free vulnerability has been identified in the Bluetooth subsystem of the Linux kernel. This issue arises in the handling of HCI (Host Controller Interface) events, specifically the HCI_EV_DISCONN_PHY_LINK_COMPLETE event. The vulnerability occurs because the event processing function, hci_send_acl, does not properly verify the connection type before deleting the connection, leading to a memory access violation. The flaw was detected in a kernel version that is part of the 5.17 release candidate series.

Impact

Exploitation of this vulnerability leads to a use-after-free condition, which can commonly be exploited to execute arbitrary code or cause a denial-of-service by crashing the system.