In the Linux kernel Bluetooth stack, the field hdev->req_status is accessed from multiple workqueues without holding the required lock. The lack of synchronization creates a data race that may result in undefined kernel behavior, including memory corruption or unexpected thread interactions, potentially allowing an attacker to destabilize the kernel.

All Linux kernel builds that contain the Bluetooth subsystem and have not yet applied the READ_ONCE()/WRITE_ONCE() annotations around hdev->req_status are affected. The specific kernel release is not identified, so any version using the relevant code path may be vulnerable.

The CVSS score of 5.5 and the EPSS score of <1% indicate a moderate severity risk in this context. The issue is not listed in CISA's KEV catalog, implying no known public exploitation. Nevertheless, a malicious actor who can send crafted Bluetooth commands could trigger the race, potentially leading to kernel instability or a denial‑of‑service. The likely attack vector is via Bluetooth traffic sent to the host, although a local attacker with elevated privileges could also exploit the unsynchronised field. Given the exploitation probability is very low, the overall risk is considered moderate due to the potential impact on kernel integrity.