The vulnerability is a use‑after‑free in the Linux kernel Bluetooth stack. When accepting a connection, bt_accept_get holds a temporary reference that is dropped too early, allowing bt_accept_dequeue to release the final reference before bt_accept_unlink. This can cause a subsequent sock_hold to touch freed memory. The flaw can lead to kernel memory corruption, potentially allowing a local or remote attacker to gain elevated privileges or execute arbitrary code. The weakness is identified as CWE‑825.

Any Linux kernel that has not yet applied the fix is affected. This includes all major distributions (e.g., Ubuntu, Fedora, Debian, CentOS) running a kernel prior to the revision that retains the temporary queue‑walk reference in bt_accept_dequeue. Exact version numbers are not specified in the advisory, but the issue exists in kernels prior to the patch commit shown in the references.

The CVSS score of 8.0 classifies the issue as high severity. The EPSS score is below 1 %, indicating a very low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The flaw is exploitable through the Bluetooth interface; an attacker would need to send crafted L2CAP packets or otherwise manipulate the accept queue during a listening session to trigger the use‑after‑free. Successful exploitation could read or overwrite kernel memory, enabling privilege escalation or code execution on the affected host.