The bug causes the Linux kernel’s Bluetooth ISO subsystem to leak a reference to the hci_dev structure every time a big sync request is processed. The reference is acquired by hci_get_route() and never released, leading to a gradual growth of the reference count and allocation of resources. Over time this exhaustion can destabilize the kernel, trigger crashes or freezes, and ultimately deny service.

The flaw exists in the Linux kernel; specific affected releases are not listed, but the issue was present before the patch commits referenced in the advisory and would affect any kernel version that utilizes the iso_conn_big_sync routine until the fix is merged. All distributions shipping an older kernel build are potentially vulnerable.

Because the vulnerability is tied to Bluetooth ISO operations, an attacker with the ability to send Bluetooth ISO frames to the host could repeatedly invoke iso_conn_big_sync and trigger the leak. No known public exploits exist and the EPSS score is not available, but the absence of a release makes the risk high for systems that remain on older kernels. The flaw is not listed in the CISA KEV catalog, yet it represents a local or remote denial‑of‑service exposure that could be abused in environments where Bluetooth access is granted.