An unprotected use‑after‑free occurs in the Linux kernel Bluetooth stack when the set_cig_params_sync function accesses an hci_conn object without acquiring the necessary hdev lock, allowing the object to be freed or modified concurrently. Dereferencing a freed object can corrupt kernel memory or cause a crash. The potential for gaining higher privileges is inferred from the severity and impact described.

All Linux kernel releases that contain the upstream Bluetooth implementation before the commits adding the hdev lock are vulnerable; this includes commonly shipped generic kernels such as 6.4.x, 6.5.x, and early 7.0 release candidates. Any distribution that distributes a kernel derived from those sources without applying the lock patch is at risk.

The CVSS score of 7.8 indicates high severity. The EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog, indicating a low probability of widespread exploitation. Evidence of publicly documented exploits is lacking; however, based on the description, it is inferred that an attacker would need local interaction with the device’s Bluetooth interface and the ability to trigger the set_cig_params_sync operation. Remote exploitation would likely require an additional local privilege escalation vector. The overall risk is moderate due to the low EPSS and lack of existing exploits.