The vulnerability is a memory leak in the Linux kernel's btmtk Bluetooth driver; the setup_packet buffer for control USB requests is not freed when usb_submit_urb fails or when the submitted URB is killed, allowing the kernel to consume memory in an unbounded manner, potentially leading to a panic or system unavailability. This flaw represents improper resource deallocation and corresponds to CWE‑401 and CWE‑772.

All Linux kernel releases that ship the btmtk Bluetooth driver are affected; the listed CPE entries cover the generic Linux kernel and the release candidates 7.1 RC1 through RC4, meaning any distribution using these kernels may be impacted.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1% suggests the probability of real-world exploitation is low; the vulnerability is not listed in CISA's KEV catalog. Based on the description, it is inferred that an attacker must trigger error paths in the driver via USB traffic or Bluetooth commands, implying that local or privileged access is required to manipulate URB submission or craft malicious control packets. Thus, the exploit is not remotely accessible but could be abused by an attacker with local or elevated permissions, and the primary mitigation is to apply a patched kernel.