Linux Kernel Bluetooth L2CAP Use-After-Free Vulnerability

A use-after-free vulnerability has been fixed in the Bluetooth L2CAP implementation of the Linux kernel. This issue arose in the functions handling disconnection requests and responses, where a channel could be referenced after it was scheduled for destruction. The vulnerability affects the stable versions of the Linux kernel.

Impact

Exploitation of this vulnerability could lead to memory corruption issues, potentially allowing for arbitrary code execution or causing a system crash.

Reproduction

The vulnerability can be reproduced by initiating a Bluetooth L2CAP connection and then sending a disconnection request or response. The improper handling of the channel reference can be observed, leading to a use-after-free condition.

Remediation

Users can upgrade to the latest stable version of the Linux kernel, where this vulnerability has been addressed.