An unprotected use‑after‑free occurs in the Linux kernel’s Bluetooth stack when the set_cig_params_sync function accesses an hci_conn object without acquiring the necessary hdev lock. Because the object may be freed or modified concurrently, dereferencing it can corrupt kernel memory or trigger a crash. The vulnerability does not explicitly mention privilege escalation, but a kernel crash or memory corruption could allow arbitrary code execution from kernel space if a local exploit is crafted.

All Linux kernel releases that contain the upstream Bluetooth implementation before the commits adding the hdev lock are vulnerable; this includes commonly shipped generic kernels such as 6.4.x, 6.5.x, and early 7.0 release candidates. Any distribution that distributes a kernel derived from those sources without applying the lock patch is at risk.

The CVSS score of 7.8 indicates high severity. The EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog, indicating a low probability of widespread exploitation. The description does not specify the required attack vector; no public exploits have been reported. The overall risk is moderate due to the low EPSS and lack of known exploits.