The Linux kernel contains a race condition in the Bluetooth ISO transport layer where iso_sock_clear_timer() accesses a connection structure without acquiring the socket lock, while iso_conn_del() may simultaneously clear the same reference under the lock. This unsynchronised access can produce a NULL pointer dereference or a use‑after‑free, potentially causing an unexpected kernel crash or allowing an attacker to execute code with elevated privileges. The likely attack vector—though not explicitly described in the advisory—would involve manipulating the timing of Bluetooth ISO traffic to trigger the race, which suggests that an attacker would need the ability to send crafted packets to the target device.

Any system running a Linux kernel version that implements the Bluetooth ISO transport layer and has not yet incorporated the commit that serialises iso_sock_clear_timer() with the socket lock. This includes older kernel releases shipped by most Linux distributions. Devices that have disabled or do not use the Bluetooth ISO module remain unaffected.

With a CVSS score of 7.8 the flaw is rated high severity, yet the EPSS score of less than 1% indicates a very low probability of spontaneous exploitation. The vulnerability is not yet listed in the CISA KEV catalog. Exploitation would most likely require local or privileged Bluetooth access, making it a medium‑to‑high impact scenario if an attacker already has a foothold or physical proximity to the device. No publicly available exploits exist at the time of this analysis.