Linux Kernel Bluetooth Command Queuing Vulnerability During HCI Unregistration

A vulnerability in the Linux kernel's Bluetooth implementation has been addressed. The issue arose in the command synchronization queue when the HCI_UNREGISTER flag was set. This flag indicates that the Bluetooth device had been unregistered, and failing to properly handle this could lead to a use-after-free error after a timeout, as the associated device structure would have been freed.

Impact

Exploitation of this vulnerability could lead to a use-after-free condition, potentially allowing for arbitrary code execution or memory corruption.