A race condition in the Linux kernel’s Bluetooth L2CAP subsystem allows concurrent manipulation of the l2cap_conn structure without appropriate locking. The functions l2cap_register_user() and l2cap_unregister_user() used hci_dev_lock instead of conn->lock, overlapping with l2cap_conn_del() and creating a use‑after‑free and list corruption scenario. If triggered, this could corrupt kernel memory or provide a foothold for code execution.

The flaw affects all Linux kernels that include the buggy Bluetooth L2CAP implementation before the commit ab4eedb790ca. As the vendor list indicates Linux:Linux, any distribution shipping an older kernel build is potentially vulnerable. The fix is incorporated in kernel revisions containing that commit, so systems running newer kernels are safe.

The CVSS score of 8.8 indicates high impact, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is via the Bluetooth interface, where an attacker could craft traffic to trigger the race condition. This inference is based on the description that the flaw involves Bluetooth L2CAP, and no publicly disclosed exploit is available.