A null pointer dereference in the Linux kernel Bluetooth L2CAP stack causes a KASAN error and triggers a kernel panic, leading to an immediate system reboot. The flaw is a classic CWE‑476 problem that can crash the machine without any user‑level privilege escalation. The vulnerability’s CVSS base score of 5.5 reflects medium severity, but because the crash renders the system unavailable, the practical impact is a denial‑of‑service to all users of the affected host.

The vulnerable component is the Bluetooth L2CAP subsystem of the Linux kernel. The patch that introduces a null‑check was merged into kernel release 7.0.0‑rc4, so any kernel revision prior to that or that does not contain the patch is potentially vulnerable. All distributions that ship unmodified or early 7.0.0 kernels are at risk, and the lack of explicit version ranges in the advisory means a broad set of systems can be affected.

The CVSS score of 5.5 indicates a medium severity rating, and the EPSS score of less than 1% suggests that exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker could trigger the crash by sending specially crafted L2CAP packets over Bluetooth or by interacting with a vulnerable Bluetooth driver from local code. The impact is a system‑wide denial of service, but no privilege escalation is mentioned in the advisory.