A use‑after‑Free bug exists in the Linux kernel’s Bluetooth USB driver (btusb) when a Marvell device fails to probe during an out‑of‑band wakeup configuration. The flaw allows a delayed completion callback to reference a freed TRANSMIT URB, corrupting kernel memory. Depending on the context this can cause a system crash or provide a foothold for an attacker to execute code with kernel privileges. The weakness is represented by CWE‑825 (Memory Deallocation Not Deallocation).

Any Linux kernel that incorporates the btusb driver for Marvell Bluetooth USB devices compiled before the fix is vulnerable. The CNA product list references only the Linux kernel with no version range, so the affected scope is inferred to cover all mainline kernels pre‑patch. Kernels that have incorporated the safety checks are considered safe.

The CVSS score of 7.0 indicates a medium to high severity, while the EPSS score of less than 1 % suggests a very low probability of real‑world exploitation currently. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be device‑centric, requiring a Marvell Bluetooth USB device that triggers a probe failure, likely via physical possession or a malicious device firmware. No public exploit exists at this time, keeping the current risk moderate under the given conditions.