The vulnerability arises from concurrent access to iso_pi fields when establishing or synchronizing ISO Bluetooth connections in the Linux kernel. These fields are read by hci_get_route without holding the necessary socket lock, creating a data race that can lead to memory corruption or incorrect routing decisions. No specific exploitation path is documented, but the flaw carries the risk of kernel instability or crashes. This race condition aligns with CWE‑820.

All Linux kernel builds that incorporate the Bluetooth ISO stack are affected. The common product identifier is Linux kernel. No version‑level constraints are provided, implying that any kernel using the relevant code path is vulnerable until the patch is applied.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score is less than 1% and the issue is not listed in the CISA KEV catalog, indicating a low probability of active exploitation as currently known. The primary consequence is potential kernel instability or crash from uncontrolled memory corruption, but no direct user‑oriented attack vector is documented. The risk is mitigated by applying the kernel patch that snapshots the offending fields before calling hci_get_route. The weakness is classified as CWE‑820 (Race Condition).