Linux Kernel CVE-2025-68304

Requires Bluetooth radio proximity (adjacent network, AV:A) to a target with an active or in-teardown Bluetooth/L2CAP connection, plus the ability to trigger connection teardown concurrently with incoming ACL data to win a use-after-free race in the RX path. Limiting factors: the target must have Bluetooth enabled and processing L2CAP ACL data; exploitation depends on winning a narrow timing window between l2cap_recv_acldata using hcon and a concurrent hci_conn_del freeing it, so it is not deterministic. No authentication is required (PR:N per the supplied vector), but physical/RF adjacency and successful race timing meaningfully constrain real-world exploitation.

Signals are mixed. The supplied CVSS 8.8 (AV:A/AC:L/PR:N/UI:N, C:H/I:H/A:H) reflects an adjacent, unauthenticated, high-impact flaw, but the AC:L rating is questionable: the vulnerability is a timing-dependent race (syzkaller reproduced it via concurrent tasks), which argues for AC:H - this is a discrepancy defenders should note. EPSS is very low (0.15%, 5th percentile), it is not in CISA KEV, and no public exploit is identified, indicating no observed exploitation. The vendor tag explicitly says 'Denial Of Service,' suggesting the realistic outcome is a kernel crash rather than reliable code execution, even though the input CVSS asserts full C/I/A impact. Net: this is a legitimate memory-safety bug worth patching in the normal kernel update cycle, but it is not an emergency - exploitation requires Bluetooth adjacency and winning a narrow race, and no weaponization is evident.

An attacker within Bluetooth radio range establishes or manipulates an ACL/L2CAP connection to a target while concurrently forcing connection teardown (e.g., abrupt disconnect), racing the RX handler against hci_conn_del so the kernel dereferences a freed hci_conn and crashes. Given AV:A and the timing-sensitive nature (effectively AC:H), the attacker must be in proximity and repeatedly trigger the race; the syzkaller reproducer demonstrates the crash but no public weaponized exploit exists.