The Linux kernel bug caused the Bluetooth synchronization function to return success even when a queue item already existed. This incorrect return value allowed callers to believe a new sync item was queued and to proceed with resource allocation or callback registration. Because duplicate items were silently ignored by the queue, resources were not cleaned up properly, leading to memory or descriptor leaks and the possibility of repeated callbacks that could degrade system performance or cause denial of service.

This issue affected the Linux kernel across all variants where the Bluetooth hci_sync subsystem is enabled. All Linux kernel versions prior to the release of the patch that corrected the return value of the hci_cmd_sync_queue_once() function are potentially impacted. Version details are not explicitly listed, but any distribution kernel including the Bluetooth stack should consider the fix in its update cycle.

The CVSS score is 5.5, EPSS score is <1%—indicating a very low likelihood of exploitation—and it is not listed in the CISA KEV catalog. The risk therefore appears moderate; no publicly documented exploitation is known. However, because the bug can cause uncontrolled resource consumption, it remains a local denial of service risk if an application can trigger repeated Bluetooth sync operations. The likely attack vector is local, requiring privilege to invoke the Bluetooth stack API or to exploit a privileged code path.