In the Linux kernel, a concurrency defect in the Bluetooth BNEP subsystem allows a use‑after‑free during network device registration. The function bnep_add_connection() reads an L2CAP connection without holding the channel lock and then passes its HCI device to register_netdev(). While this occurs, a controller teardown can concurrently clear and release the connection, causing the registration path to dereference a freed parent device. This bug can corrupt memory, crash the system, or be leveraged for privilege escalation if an attacker can trigger the race.

All releases of the Linux kernel that contain the unpatched BNEP implementation are vulnerable. The issue exists before the commit that protected the L2CAP reference with a channel lock and was fixed in the latest kernel series. Exact version numbers are not listed, so any kernel without the patch should be considered at risk.

The EPSS score of less than 1% indicates a very low probability of exploitation in the wild, while the CVSS score of 8.8 reflects a high severity vulnerability. The likely attack vector is an attacker‑controlled Bluetooth device that attempts to trigger a race condition during BNEP netdev registration; remote exploitation would remain improbable without privileged access to the system or the ability to interact directly with the Bluetooth stack. Practical exploitation is challenged by the need for specialized timing tools, but if achieved, could lead to memory corruption, denial of service, or elevation of privileges.