The vulnerability is caused by improper handling of pending Bluetooth management commands in the Linux kernel, where previously executed commands are unlinked and freed too early. This misbehavior can corrupt the kernel’s internal command list or dereference freed memory, causing a kernel panic or enabling an attacker to execute arbitrary code with escalated privileges when the affected handlers are invoked.

All Linux kernel releases that contain the buggy Bluetooth MGMT code before the commit that introduced the fix. The affected product is the official Linux kernel, and the fix is part of the patch that adds mgmt_pending_valid() semantics. No specific version numbers are listed, so any kernel that has not yet incorporated this change is potentially vulnerable.

The CVSS score of 7.8 indicates high severity, and the EPSS score of < 1% reflects a low current exploitation probability. The vulnerability is not included in CISA KEV catalog. When triggered, the flaw can corrupt kernel memory or free objects prematurely. Based on the description, it is inferred that an attacker would need to influence the Bluetooth stack—either through local control of Bluetooth commands or via an exposed Bluetooth service—to exercise the vulnerable handlers. Remote exploitation is possible only if the system’s Bluetooth service is reachable from outside, but this is an inference rather than confirmed data. The risk remains until the kernel is patched with the commit that corrects the list handling logic.