The Linux kernel Bluetooth subsystem's hci_core component had a concurrency flaw in the RX packet processing path. The locking pattern around hci_conn lookup and usage did not prevent concurrent modification or deletion of hci_conn pointers, leading to use-after-free conditions. This was due to leftover locking from before the connection hash used RCU and code paths that delete hci_conn outside the expected workqueue context. The fix involved moving the lookup and usage of hci_conn within a single critical section in protocol receive handlers to prevent concurrent unsafe access. The vulnerability is tracked as CVE-2025-68304 and was identified through syzkaller crash reports.

Successful exploitation of this vulnerability can lead to use-after-free conditions in the kernel Bluetooth stack, potentially causing system crashes (denial of service) or allowing attackers to execute arbitrary code with kernel privileges, impacting confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no explicit patch or vendor advisory is provided, users should monitor official Linux kernel security advisories for updates addressing CVE-2025-68304 and apply them promptly once available.