Linux Kernel Bluetooth Race Condition Vulnerability Leading to Use-After-Free

A race condition vulnerability has been identified in the Bluetooth subsystem of the Linux kernel. This issue arises from a potential use-after-free scenario involving the 'hci_cmd_sync_work' and 'hci_cmd_sync_clear' functions. The vulnerability occurs because 'hci_cmd_sync_work' is queued to the 'req_workqueue' after 'cancel_work_sync' is called. Meanwhile, 'hci_cmd_sync_clear' can free the corresponding entry in the 'cmd_sync_work_list', leading to a kernel panic when the freed entry is accessed in 'hci_cmd_sync_work'.

Impact

Exploitation of this vulnerability causes a kernel panic, disrupting system operations and potentially leading to a denial of service.