The vulnerability arises from improper handling of pending Bluetooth management commands in the Linux kernel. A recent change unlinks and frees commands earlier than expected, causing a double list deletion in one completion handler and a use‑after‑free in another. When triggered, this flaw can corrupt the kernel's internal command list or free objects that are still in use. Such memory corruption can lead to kernel panic or allow an attacker to execute arbitrary code with elevated privileges. The description indicates that the bug is fixed in a later commit, so any system running an affected Linux kernel version is susceptible until the patch is applied.

All Linux kernel releases that include the buggy Bluetooth MGMT code, prior to the 302a1f674c00 update. The affected products are the official Linux kernel provided by the Linux Foundation. No specific version numbers are listed, so the recommendation is to upgrade to any Linux kernel version that includes the patch or later.

The CVSS score is not provided, but a use‑after‑free in kernel space can be classified as a high‑severity vulnerability. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation would likely require local control of the Bluetooth stack, though remote exploitation could be possible if the system exposes its Bluetooth service to external agents. Given the severity and the lack of mitigating controls, the risk of privilege escalation remains high until the patch is applied.