The Linux kernel’s Bluetooth L2CAP implementation contains a flaw that can cause a kernel panic when a device sends a specially crafted packet with a destination CID (dcid) that conflicts with an already‑assigned channel. The bug arises because the code attempts to delete or clone a channel while the list cursor is still in use, corrupting memory and triggering a crash. The result is a denial‑of‑service that disrupts availability but does not compromise confidentiality or integrity.

This issue affects all Linux kernel builds that include the unpatched Bluetooth L2CAP subsystem. Every distribution shipping an original kernel version before the upstream crash fix is vulnerable until the vendor releases a patched kernel package. The problem is present in the generic Linux kernel code and therefore applies regardless of the distribution vendor.

The CVSS base score of 8.8 reflects a high‑risk vulnerability, while the EPSS score of <1% indicates a low probability of exploitation at present. The flaw is not listed in CISA’s KEV catalog. Based on the description of the flaw, the likely attack vector involves sending a crafted packet over the Bluetooth L2CAP interface; this inference comes from the requirement to send a conflicting dcid. Because the exploit only requires the ability to transmit data over Bluetooth and does not need elevated privileges, it is inferred that no special access or physical proximity beyond normal Bluetooth communication is required for exploitation.