CyberRota Analysis
AI-GeneratedThe vulnerability affects the Linux kernel's Bluetooth management, specifically in handling connections where dereferencing RCU-protected pointers outside critical sections can lead to use-after-free (UAF) conditions. This flaw may allow an attacker to exploit the Bluetooth stack, potentially leading to unauthorized access or system instability. Organizations using Linux systems with Bluetooth capabilities should prioritize this issue to mitigate risks associated with potential exploitation.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds Dereferencing RCU-protected pointers outside critical sections is invalid and may lead to UAF. Use of hci_conn in hci_sync callbacks also needs to hold refcount to avoid UAF. Take appropriate locks for hci_conn lookups, and take refcount for hci_conn pointers stored in mgmt_pending_cmd so that the pointer stays valid. When accessing conn->state, ensure hdev->lock is held to avoid data race.