The Linux kernel's Bluetooth bnep subsystem contained a use-after-free vulnerability caused by bnep_add_connection() not holding the bnep_session_sem lock while reading dev->name. This allowed a concurrent bnep_session() thread to free the net_device, potentially leading to a UAF read. Exploitation requires CAP_NET_ADMIN capability and a narrow race window involving tearing down a net_device. The issue was fixed by ensuring the lock is held during the read, preventing concurrent free operations. This vulnerability is part of a broader set of Linux kernel fixes addressing multiple subsystems.

An attacker with CAP_NET_ADMIN privileges could exploit this vulnerability to cause a use-after-free read in the Bluetooth bnep subsystem, potentially leading to information disclosure or system instability. However, the requirement for elevated privileges and a precise race condition reduces the likelihood of exploitation. The CVSS score is 8.8, indicating high impact if exploited, but practical exploitation is constrained by the conditions needed.

A patch is available and should be applied by updating the Linux kernel to the fixed versions. The vendor advisory from Ubuntu confirms that the issue is resolved in updated kernel packages. After applying the update, a system reboot is required. No additional mitigations are necessary as the vulnerability requires CAP_NET_ADMIN privileges and is addressed by the official fix.