The bug is a memory leak in the Bluetooth btmtk driver. The setup_packet buffer for control USB requests is not freed when usb_submit_urb fails or the urb is killed. This leak can gradually consume memory and may lead to a denial of service. The weakness is classified as CWE-772.

The vulnerability is present in any Linux kernel that ships the btmtk Bluetooth driver. No specific kernel versions are listed, so all affected distributions should consider their current kernel revision.

The CVSS score is 5.5, indicating moderate severity. The EPSS score is less than 1%, implying a low probability of exploitation in the wild. The vulnerability is not in the KEV catalog. Attackers could trigger memory exhaustion by interacting with the driver via malicious USB traffic or Bluetooth commands, but an exploit would likely require local access or privileged execution to take advantage of the error paths. The fix addresses the issue directly; until a patched kernel is deployed, the risk remains.