This bug is a use‑after‑free in the Bluetooth management subsystem of the Linux kernel. During device completion a worker thread accesses connection‑parameter data without holding the required lock, while another thread may free the same structure. That dereference touches freed memory and triggers a kernel crash, a classic denial‑of‑service condition.

All Linux kernel builds that ship the Bluetooth mgmt.c implementation are potentially affected. The descriptive data reference a 7.x kernel build, but the flaw exists in any kernel version prior to the commit that applies the lock fix. Systems with the Bluetooth driver enabled are at risk.

The CVSS score of 5.5 and an EPSS score of less than 1 % suggest a medium severity with a low probability of exploitation. The likely attack vector requires an adversary to influence the kernel worker via Bluetooth management commands, which can be sent locally or by a compromised privileged process. This inference is drawn from the mention of hci_cmd_sync_work and concurrent MGMT_OP_REMOVE_DEVICE operations in the description. If exploited, the use‑after‑free leads to a kernel panic that causes a system crash and downtime. The vulnerability is not listed in CISA’s KEV catalog.