This vulnerability is a use‑after‑free in the Linux kernel’s Bluetooth ISO stack. In iso_recv_frame, the socket reference is released before the spinlock is dropped, giving a concurrent iso_sock_kill() the opportunity to free the socket and leave the code to dereference an invalid pointer. The flaw can result in memory corruption or a kernel crash, which in the right conditions could allow an attacker to execute arbitrary code.

All Linux kernel releases that incorporate the original iso_recv_frame implementation are affected. The vulnerability was fixed in the kernel commit 119fb6f80c44dc1c65d604cf28e64c56bd9b6568, so any distribution using a kernel older than that commit is impacted. Users of any Linux distribution that has not yet applied the patch, or are running a kernel backported without the fix, remain vulnerable.

The CVSS base score of 8.8 represents a high‑severity security flaw but does not directly indicate the likelihood of exploitation. The EPSS score of less than 1% shows that, at the time of this analysis, the probability of an exploit being seen in the wild is low. The vulnerability is not listed in the U.S. CISA KEV catalog. Exploitation would require crafting a race condition between iso_recv_frame and iso_sock_kill(), typically through a malicious Bluetooth ISO packet or an active local user with the ability to send such frames. If the machine’s Bluetooth services are exposed to remote devices, an attacker could potentially trigger the condition without local access, although the specific feasibility depends on the system’s Bluetooth configuration and security policies.