A missing database lock in the Linux kernel Bluetooth HCI event handler allows the hci_conn structure to be freed while still referenced, leading to a use‑after‑free vulnerability. The flaw can cause memory corruption, which may result in a kernel crash or other unintended kernel behavior. No explicit remote code execution or privilege escalation has been documented in the official description.

The vulnerability is present in the Linux kernel’s Bluetooth HCI implementation, specifically in the hci_le_remote_conn_param_req_evt handler. All kernel releases that contain the vulnerable code and have not been patched, including the Linux 7.0 release candidates 1 through 6, are potentially affected.

The CVSS score of 8.8 indicates high severity, and the EPSS score of less than 1% indicates a low likelihood of exploitation at present. The flaw is not listed in the CISA KEV catalog. Kernel‑level use‑after‑free errors can compromise system stability and may affect confidentiality, integrity, and availability. Exploitation would require triggering the freed object scenario, which is typically tied to Bluetooth operations.