The vulnerability is a use‑after‑free in the Bluetooth HIDP stack of the Linux kernel. When a user‑remove callback is invoked for a Bluetooth connection, the code fails to drop the l2cap_conn reference, resulting in the structure being freed while it may still be needed. This flaw can lead to memory corruption or a kernel crash, as demonstrated by the stack trace captured during testing.

Any system running a Linux kernel that contains the default Bluetooth HIDP implementation and does not include the recent commits that address the reference‑counting bug is potentially affected. The advisory does not list specific kernel releases, so administrators should verify whether their kernel version contains the relevant changes. The impact is limited to the Linux kernel as a whole, with Bluetooth support enabled.

The CVSS base score of 8.8 indicates high severity. The EPSS score is < 1%, and the vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. The likely attack vector involves interaction via Bluetooth traffic, either from a local device or a remote attacker who can pair with the target. Based on the description, it is inferred that an attacker exploiting this flaw could cause a kernel panic or corrupt kernel memory, potentially enabling further compromise if the freed memory is controlled.