The vulnerability originates from improperly flushed workqueues and missing locks in the Linux kernel Bluetooth hci_uart driver. During TTY close or initialization error paths, the driver may free the hu structure before scheduled work executes, causing use‑after‑free (UAF) and null pointer dereference (NPD) conditions. These flaws enable kernel memory corruption, which could be leveraged by an attacker with local access to the Bluetooth subsystem to execute arbitrary code or crash the system.

All Linux kernel releases that ship the hci_uart driver without the patch are affected. The vendor is Linux and the product is the Linux kernel. No specific affected version range is listed in the metadata, so any kernel prior to the implementation of the cited patches is considered vulnerable.

EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, so industry‑wide exploitation probability is unknown. The CVSS score is unspecified. The most likely attack vector is local or remote interaction with the Bluetooth stack: an attacker could initiate a malformed Bluetooth connection or exploit a driver misuse to trigger the faulty path. Because the flaw consumes kernel resources, successful exploitation could lead to privilege escalation, arbitrary code execution with kernel privileges, or denial of service. The lack of public exploits suggests the risk is moderate to high for systems that expose the Bluetooth interface to untrusted devices.