The flaw lies in the Linux Bluetooth subsystem where connection objects are accessed without proper locking during SSP passkey notifications, allowing a use‑after‑free. This can corrupt kernel memory or enable arbitrary code execution if an attacker can trigger the vulnerable functions while the connection is freed, potentially escalating privileges or crashing the system.

All Linux kernel versions that implement the Bluetooth hci_event handlers without the lock fix are impacted. The specific versions are not listed but the issue resides in the general Bluetooth stack of the kernel.

No CVSS score is provided, but the kernel‑level use‑after‑free is high severity. The EPSS score is not available and the vulnerability is not included in the CISA KEV catalog. The attack vector likely requires a Bluetooth SSP client that can send a passkey event, so the attacker needs physical proximity or the ability to pair with the target device.