The Linux kernel’s Bluetooth hci_sync component fails to release references when hci_cmd_sync_queue_once returns an error, which leaves memory unreleased. If the failure occurs repeatedly, the kernel can exhaust its memory pool, degrading performance or causing a crash. The flaw is an improper cleanup on failure (CWE-772) that results in a memory leak (CWE-401).

All Linux kernels that implement the Bluetooth hci_sync responsible for packet synchronization are potentially impacted. The vulnerability does not specify exact versions, so any kernel that predates the patch commit which introduced the leak fix remains vulnerable.

The CVSS score of 5.5 indicates medium severity. The EPSS score of 0.00024 (<1%) indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The flaw likely requires an attacker to induce a queue failure, which can be achieved by sending malformed Bluetooth commands or stressing the Bluetooth controller; therefore the attack vector is inferred to be through the Bluetooth interface. While no public exploits are documented, repeated failures could lead to memory exhaustion and cause a denial of service.