The Linux kernel bug involving the btusb Bluetooth driver causes a use‑after‑free when controller registration fails. After the failure the driver leaves its sibling interfaces unreleased, and if the device later disconnects a double‑free can occur, corrupting kernel memory and enabling an attacker to gain arbitrary execution or trigger a denial of service in kernel mode.

All Linux kernel releases that contain the unpatched btusb code path are potentially affected. The CNA data does not list specific affected versions, so this statement is inferred from the absence of version information; systems running kernel versions prior to the patch that introduces the fix are considered vulnerable.

The EPSS score is below 1 % and the vulnerability is not listed in CISA’s KEV catalog, suggesting it is rarely exploited. Because the bug occurs in kernel space, it can have severe impact if an attacker can trigger a registration failure—likely requiring local access to the Bluetooth subsystem or the ability to manipulate the btusb probe path. Consequently, the risk remains high for systems that expose the Bluetooth driver and run vulnerable kernel versions.