A use‑after‑free flaw exists in the Linux kernel Bluetooth HCI subsystem during the creation of a BIG (Basic Identification Group) connection. The defect occurs when the create_big_sync() function fails to validate a stale hci_conn object before proceeding, causing create_big_complete() to dereference a pointer that may already have been freed. This kernel‑level memory corruption can allow an attacker with sufficient access to a Bluetooth device or to influence the BIG transaction sequence to execute arbitrary code, crash the system, or elevate privileges.

All Linux kernel releases that do not include the hci_conn_valid() patch in the Bluetooth HCI driver. The issue applies to any kernel build prior to the commit that added the staleness check, regardless of distribution, because the vulnerability is in core Linux kernel code and not limited to a specific vendor.

The CVSS score is 5.5 and the EPSS score is < 1%, indicating no confirmed public exploits at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that exploitation would most likely require a local or privileged attacker who can manipulate a Bluetooth device to trigger the flawed BIG transaction sequence, or a remote attacker that can influence the device’s Bluetooth stack. The potential impact is medium due to the kernel location, but the lack of publicly documented exploits reduces immediate risk, though the vulnerability remains serious.