The Linux kernel’s btintel Bluetooth driver can issue two synchronous HCI commands in btintel_hw_error() without holding the hci_req_sync_lock. When a shutdown routine also issues synchronous HCI commands under the same lock, concurrent manipulation of hdev->req_status and hdev->req_rsp can occur. The close path may free the response skb first, and the still-running hw_error path, which has not yet released the lock, then accesses that freed skb, resulting in a slab‑use‑after‑free during kfree_skb. This use‑after‑free causes a kernel crash and represents a denial‑of‑service flaw. Based on the description, it is inferred that an attacker would need to trigger the race condition through concurrent Bluetooth operations.

All Linux kernel builds that include the btintel Bluetooth module and have not yet incorporated the hci_req_sync_lock serialization fix are vulnerable. The supplied CPE entries reference the generic Linux kernel, as well as specific releases such as 4.3 and the 7.0 release candidates 1 through 7, indicating that a broad swath of kernel versions may be affected.

The CVSS score of 7.8 indicates a moderate to high severity. The EPSS score is below 1 % and the vulnerability is not listed in CISA’s KEV catalog, suggesting a low likelihood of active exploitation. Exploitation would require a local attacker to trigger the race condition by generating simultaneous HCI commands and a close operation against the Bluetooth stack, leading to a kernel crash and service interruption. The likely attack vector is a local race condition induced by concurrently issuing Bluetooth HCI commands while closing the adapter. The overall risk is moderate, and prompt patching is recommended.