The Linux kernel’s Bluetooth BNEP subsystem contains a race condition in the bnep_add_connection function. The function reads an L2CAP connection without holding the channel lock and passes the associated HCI device to register_netdev. If a controller teardown concurrently clears and releases that connection, the later reference to the parent device becomes a use‑after‑free. This flaw is a classic use‑after‑free weakness (CWE‑825) that can result in memory corruption, kernel panic, or system crash. The CVE description does not mention any successful exploitation of arbitrary code execution or privilege escalation; those outcomes are not explicitly supported by the supplied information.

All Linux kernel releases containing the unpatched BNEP code are affected, including the versions identified in the CPE list such as 7.2‑rc1 and 7.2‑rc2, as well as any prior kernel branches that have not incorporated the commit that secures the L2CAP reference with the channel lock. The vendor designation indicates the Linux kernel under the Linux project.

The CVSS score of 8.8 classifies the flaw as high severity, while the EPSS score of less than 1% denotes a low likelihood of field exploitation at the time of this analysis. Exploitation would require an attacker‑controlled Bluetooth device able to initiate the BNEP registration race, making the attack scenario technically difficult to achieve. The vulnerability is not listed in CISA KEV, and no publicly known exploits are available.