A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel
HCI subsystem was found in the way user calls ioct UFFDIO_REGISTER or other
way triggers race condition of the call sco_conn_del() together with the
call sco_sock_sendmsg() with the expected controllable faulting memory
page. A privileged local user could use this flaw to crash the system or
escalate their privileges on the system.

It was discovered that the Bluetooth subsystem in the Linux kernel
contained a use-after-free vulnerability. A local attacker could use this
to cause a denial of service (system crash) or possibly execute arbitrary
code.

sbeattie

Possibly addressed by Desmond Cheong Zhi Xi's patchset. may need additional prerequisite commits