The flaw lies in the Linux kernel Bluetooth stack’s hci_dev_close_sync routine, which fails to set the HCI_CMD_DRAIN_WORKQUEUE flag when a device is closed or reset. This oversight can cause timeout entries to linger on the workqueue as it drains, potentially stalling the Bluetooth subsystem or causing a crash. The weakness is a logical error classified as CWE-366 and also represents uncontrolled resource consumption (CWE-400), where deferred work can accumulate and exhaust system resources, leading to a denial‑of‑service condition for Bluetooth operations.

All Linux installations running kernel revisions that contain the pre‑fix implementation of hci_dev_close_sync are affected. The vulnerability is tied to the generic Linux kernel product, with no specific version range provided; therefore, any kernel version that predates the commit referenced in the supplied Git links remains vulnerable.

The CVSS score of 8.8 marks the issue as high severity, while the EPSS score of less than 1% indicates that real‑world exploitation is unlikely at present. It does not appear in the CISA KEV catalog. Exploitation would require an actor to trigger a Bluetooth device reset or close event, which is usually a local or remote condition that an attacker can induce. Given the low EPSS, the immediate risk is moderate, but the impact if an attacker succeeds is a complete denial of Bluetooth services. The weakness also involves uncontrolled resource consumption (CWE-400), meaning that repeated or prolonged draining attempts could lead to system resource exhaustion.