CVE-2025-68304

A use-after-free vulnerability was found in the Linux kernel's Bluetooth subsystem. The hci_conn lookup on the RX path uses a lock/lookup/unlock/use pattern that doesn't prevent concurrent deletion of the hci_conn structure. When hci_abort_conn_sync() or similar functions delete the connection while RX processing is ongoing, a use-after-free occurs.

Exploitation requires Bluetooth connectivity and specific timing between connection teardown and packet reception. Physical proximity or a compromised paired device may be required.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.