The vulnerability is a use‑after‑free (UAF) in the Linux kernel’s Bluetooth ISO stack. In the function iso_recv_frame, the socket pointer conn->sk is read while the ISO connection lock is held, but the lock is released before the socket is dereferenced; a concurrent iso_sock_kill operation can free the socket in that window, causing an UAF when iso_recv_frame later accesses the socket’s state or queues a received packet. This flaw can lead to kernel memory corruption or a crash, and it may allow an attacker who can trigger the race to gain kernel execution, though the CVE description does not explicitly state a successful code‑execution scenario.

All Linux kernel releases that contain the original iso_recv_frame implementation prior to the commit 119fb6f80c44dc1c65d604cf28e64c56bd9b6568 are affected. This includes the general Linux kernel line and the 7.1 release candidates (rc1 through rc5). Any distribution using those kernel versions, or a backported kernel that has not incorporated the patch, remains vulnerable.

The CVSS base score of 8.8 indicates a high‑severity flaw. The EPSS score is less than 1% , reflecting a low probability of exploitation observed in the wild at the time of analysis. The vulnerability is not listed in the U.S. CISA KEV catalog. Based on the description, it is inferred that the attack vector most likely requires a race condition between iso_recv_frame and iso_sock_kill, which could be triggered by malicious Bluetooth ISO packets or an active local user capable of sending such frames. If Bluetooth services are exposed and properly configured, remote devices might be able to send the packets that induce the race; otherwise, local privilege or physical access is necessary.