A missing lock around the l2cap_chan_del() call in the l2cap_ecred_reconf_rsp function allows a remote Bluetooth Low Energy device to send a crafted L2CAP ECRED reconfiguration response that corrupts the channel list while other kernel threads are iterating it. The corruption can lead to kernel crashes or service interruption, effectively denying legitimate users from using Bluetooth services without proper recovery.

Linux kernel implementations that have not yet incorporated the patch that adds proper channel locking and reference handling around l2cap_chan_del during ECRED reconfiguration. No specific kernel version range is provided, so any kernel that includes the old implementation is potentially vulnerable.

The vulnerability requires a nearby or connected BLE device that can transmit a malformed L2CAP ECRED response, a scenario that is feasible in many wireless environments. The absence of a CVSS rating and EPSS score in the available data does not change the fact that the missing synchronization introduces a race condition that can be exploited by an attacker. The lack of inclusion in the CISA KEV catalog suggests no widely known exploitation, but the attack vector remains active in environments where BLE devices communicate with Linux systems.