In the Linux kernel’s Bluetooth L2CAP layer, the callback l2cap_sock_new_connection_cb() historically returned a child socket after the parent lock was released, allowing another task to accept and free that socket before the callback dereferenced it. This allows a use‑after‑free error, categorized as CWE‑416 and CWE‑825, which can cause kernel crashes or potentially enable arbitrary kernel code execution if the freed memory is reused maliciously.

All Linux kernel builds that include the vulnerable l2cap_sock_new_connection_cb() code path are potentially affected. The advisory does not list specific kernel versions, so any kernel lacking the recent patch may be at risk. The impact applies to any system running the Linux kernel where the Bluetooth stack is enabled.

The CVSS score of 8.8 indicates high severity. The EPSS score of less than 1% suggests a low likelihood of exploitation in the wild, and it is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker would need to establish an L2CAP connection using a rogue Bluetooth device; thus, the likely attack vector is a near‑neighbor Bluetooth host that can trigger the flawed callback. The vulnerability does not require user interaction but may be difficult to exploit without knowledge of the kernel’s Bluetooth implementation.