Vulnerability leverages a race condition in the Linux kernel’s Bluetooth SCO subsystem, where the function sco_sock_connect() checks sk_state and sk_type without acquiring the socket lock. This flaw allows two concurrent connect() system calls on the same socket to bypass the state check, both entering sco_connect() and creating a use‑after‑free when the second path deletes the socket. The potential impact is kernel memory corruption that could lead to a kernel panic or, in the best‑case scenario, execution of arbitrary code with kernel privileges. This statement about a kernel panic or arbitrary code execution is inferred from the nature of the use‑after‑free and is not explicitly stated in the input.

Affected systems are all Linux kernel versions that have not yet incorporated the upstream patch referenced in the Git commits listed in the advisory. The CVE entry lists the vendor as Linux, and no specific product version is published, so any kernel built from source before the patch is considered vulnerable. Administrators should verify the running kernel’s build ID against the commit history to confirm vulnerability status.

The CVSS score of 7.8 indicates a high severity, and the vulnerability is not listed in CISA KEV catalog. The EPSS score of < 1% indicates a very low probability of exploitation at this time. The absence of a known public exploit further reduces the immediate threat. The likely attack vector is an attacker with access to the Bluetooth interface that can issue concurrent connect() syscalls on the same socket, which would trigger the race condition. This inference is based on the description of the concurrent connect scenario, as the attack system’s access requirements are not explicitly described in the input.