The defect resides in the Linux Bluetooth subsystem, where transmit timestamping enables sk_buff instances to be queued into sk_error_queue. The kernel fails to clear this queue during socket cleanup, so the queued sk_buffs persist until the user processes the timestamps or until the Bluetooth controller is disconnected. Because the items remain in memory, repeated creation and destruction of Bluetooth sockets can consume kernel memory, potentially exhausting the system and resulting in a denial of service. This weakness is a classic resource‑leak scenario (CWE‑772).

The issue affects the Linux kernel’s Bluetooth implementation. All distributions running a kernel build that contains the buggy Bluetooth socket destructors and that enable SO_TIMESTAMPING are potentially impacted. The specific kernel versions are not listed in the advisory, so administrators should check whether their kernel series includes this change as part of recent updates.

The packaged CVSS score is 5.5, reflecting a moderate impact and requiring operators or local users to invoke Bluetooth socket operations. The EPSS score of less than 1% suggests that exploitation is unlikely at present, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves a user or application that repeatedly opens and closes Bluetooth sockets with timestamping enabled, eventually exhausting kernel memory. Because the flaw is a kernel resource leak rather than an immediate privilege‑escalation flaw, it is generally mitigated by applying the kernel patch before a DoS occurs.