The flaw lies in the Linux kernel Bluetooth hci_sync subsystem. During a call to hci_le_create_cis_sync(), the function releases the RCU read lock and the hci_dev_lock before dereferencing conn->conn_timeout, a pointer taken from the hci_conn hash list. If a disconnect occurs concurrently, the hci_conn structure can be freed after those locks are released, leading to a use‑after‑free read of kernel memory. Based on the description, this kernel memory corruption can trigger a crash or corrupt critical data structures, and if combined with other weaknesses could enable privilege escalation. The weakness is a classic use‑after‑free (CWE‑416) triggered by improper lock handling (CWE‑364).

Based on the description, all Linux kernel releases that compile with the Bluetooth subsystem and the hci_sync feature are potentially affected until the commit that stores the timeout value locally is merged. Distribution kernels that have not yet applied that patch—including many recent stable releases prior to the 2026‑07 changes—remain vulnerable. Any device using Bluetooth and performing HCI operations, such as laptops, embedded controllers, or IoT endpoints, runs the vulnerable code path when a hci_conn is active.

The CVSS score of 8.8 classifies the flaw as high severity. The EPSS score of less than 1 % indicates a low probability of current exploitation, and the vulnerability is not listed in CISA's KEV catalog. Based on the description, the likely attack vector involves an attacker with local or privileged access who can orchestrate a race between initiating an HCI operation and disconnecting a Bluetooth session, then observe the resulting memory corruption. This requires precise timing and local control, making exploitation difficult but still feasible. Based on the available data, the impact of a successful attack could be severe, potentially allowing kernel compromise and privileged escalation.