The vulnerability is a use‑after‑free in the Bluetooth subsystem of the Linux kernel. When a Bluetooth connection is accepted, the function that walks the accept queue drops a temporary reference too early, causing the subsequent unlink operation to release the final reference before the queue is fully cleared. The following sock_hold() then accesses memory that has already been freed, as reported by KASAN. This flaw can corrupt kernel memory and is identified as CWE‑416. An attacker who can force a L2CAP listening socket to exercise this code path might read or overwrite privileged data, enabling elevated privileges or arbitrary code execution.

All Linux kernel releases that have not incorporated the patch are affected. The CPE strings explicitly list Linux kernel 7.1 and various release candidates for 7.2 (RC1, RC2, RC5, RC6, RC7). Earlier stable releases are also likely vulnerable until the fix is applied. Any distribution that ships one of these kernel versions and runs the Bluetooth stack is impacted.

The CVSS score of 8.0 indicates high severity, while the EPSS score of less than 1 % reflects a very low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to send crafted Bluetooth packets or otherwise manipulate the accept queue during a listening session. If successful, the attacker could read or write kernel memory, leading to privilege escalation or full system compromise.