The flaw arises from a dangling pointer in the Linux kernel Bluetooth MGMT code, corresponding to CWE‑416 use‑after‑free and CWE‑825 use‑after‑free. When a pending command is freed without unlinking it from the internal list, a stale pointer remains. Subsequent list traversals, such as those performed during power‑off or additional validation calls, dereference this freed memory, leading to kernel memory corruption and crashes. The potential for arbitrary code execution is inferred from the nature of the vulnerability but is not explicitly stated in the CVE description.

All Linux kernel releases that contain the legacy mgmt_add_adv_patterns_monitor_complete implementation and have not yet incorporated the vendor‑supplied patch are affected. Devices exposing a Bluetooth management interface on these kernels are at risk.

The CVSS score of 7.8 indicates high severity. The EPSS score is less than 1%, indicating a low but non‑zero likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. It resides in privileged kernel code and could be triggered by an unauthenticated user sending crafted Bluetooth MGMT packets, an attack vector that is inferred from the nature of the vulnerability but is not explicitly described. An attacker could cause a crash (denial of service) or potentially execute code with elevated privileges, depending on the execution context of the freed memory; these outcomes are also inferred and not explicitly detailed in the CVE description.