CVE-2025-68304: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68304 is a use-after-free (UAF) vulnerability in the Linux kernel's Bluetooth hci_core component, specifically in the packet receive (RX) path. The flaw arises from inadequate locking that fails to prevent concurrent modification or deletion of hci_conn structures, leading to a race condition between kernel tasks. It was disclosed on December 16, 2025, and affects the Linux kernel across multiple stable branches. The vulnerability carries a CVSS v3.1 base score of 7.0 (High) (Red Hat CVE, Red Hat Bugzilla).

The root cause is a use-after-free condition (CWE-416) in the Bluetooth hci_core subsystem. The hdev lock/lookup/unlock/use pattern in the packet RX path does not guarantee that an hci_conn pointer remains valid after the lock is released, because other code paths (e.g., hci_abort_conn_sync) can delete hci_conn objects from outside the ordered hdev->workqueue. The race condition manifests when one task executes l2cap_recv_acldata(hcon) while a concurrent task runs hci_disconnect_all_sync, which calls hci_conn_del(hcon) — leaving the first task to dereference a freed hcon->l2cap_data pointer. The fix moves hci_conn lookup and associated socket-specific connection lookup into protocol receive handlers within a single critical section. The issue was discovered via syzkaller fuzzing (Red Hat Bugzilla).

Successful exploitation could allow a low-privileged local attacker to corrupt kernel memory, potentially leading to a kernel crash (denial of service), privilege escalation, or arbitrary code execution. The vulnerability affects the confidentiality, integrity, and availability of the system at a high level, as kernel memory corruption can expose sensitive data or allow an attacker to gain elevated privileges. Systems with active Bluetooth functionality are at greatest risk (Red Hat CVE, Red Hat Bugzilla).

The primary remediation is to apply the latest Linux kernel security updates that include the fix, which moves hci_conn lookup into protocol receive handlers within a proper critical section. Ubuntu has released multiple security notices addressing this CVE: USN-8094-1 through USN-8094-5, and USN-8152-1 (Ubuntu USN-8094-1, Ubuntu USN-8152-1). As a workaround, administrators should disable Bluetooth functionality on systems where it is not required, and restrict local user access to minimize the attack surface (Red Hat CVE).