In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback There is theoretical UAF if the conn is freed while the hci_sync task is running. Hold refcount to avoid that.Referenceshttps://git.kernel.org/stable/c/c53c70ec289ee12f20c4f1b2fbfd151762c01f67https://git.kernel.org/stable/c/44fc74069d8988f2825246f9401218e29de2c0ab
