The Linux kernel Bluetooth subsystem contained a use-after-free vulnerability in the hci_unregister_dev() function. Specifically, the cmd_timer and ncmd_timer timers were not disabled before the hci_dev structure was freed. If a timer timeout fired during device teardown, the callback would dereference freed memory, including the hdev->reset function pointer, causing a use-after-free condition. The patch added disable_delayed_work_sync() calls alongside existing disable_work_sync() calls to ensure both timers are fully stopped before the device structure is freed, preventing the use-after-free.

This vulnerability could cause kernel instability or crashes due to use-after-free memory dereferences in the Bluetooth subsystem during device teardown. There is no information about exploitation in the wild or privilege escalation. The impact is limited to potential denial of service or system instability.

A fix has been implemented that disables the relevant timers before freeing the device structure, preventing the use-after-free condition. Users should apply the official Linux kernel updates that include this patch to remediate the vulnerability. No additional mitigation steps are indicated.