The Linux kernel Bluetooth subsystem contains a flaw where the function hci_conn_request_evt() calls hci_connect_cfm(conn) without holding the required device lock when the HCI_PROTO_DEFER flag is set. hci_connect_cfm() normally assumes the lock is held; if the connection object is deleted concurrently, a use‑after‑free occurs. This is a classic race condition (CWE‑364) and a concurrency violation (CWE‑667). An attacker could exploit the UAF to corrupt memory or execute arbitrary code as the kernel.

All Linux kernel builds that expose the Bluetooth stack and invoke the hci_conn_request_evt() path are potentially affected. The problematic code paths are exercised for SCO connections that use deferred listening sockets, and to a limited extent for ISO connections. No specific kernel release is listed, so any kernel version before the commit that adds the missing lock hold is vulnerable. Administrators should verify whether their kernel includes the patch that holds the device lock during hci_connect_cfm() calls.

The vulnerability requires a race between a deferred connection request and a concurrent deletion of the same connection object, implying a local or privileged attacker with sufficient control to trigger both actions. The CVSS score of 8.8 indicates high severity, while the EPSS score of <1% suggests limited likelihood of exploitation at the time. The issue is not listed in the CISA KEV catalog, meaning no publicly known active exploitation was documented when the advisory was released. Nevertheless, a use‑after‑free in the kernel could lead to privilege escalation or system compromise and should be addressed promptly.