An untrusted Bluetooth host can trigger a use‑after‑free in the Linux kernel's L2CAP layer. The vulnerability arises in l2cap_sock_new_connection_cb() when a child socket is returned after the parent socket’s lock is released, allowing another task to free that socket before the callback dereferences it. This flaw, a classic use‑after‑free (CWE‑825), can cause an out‑of‑bounds access that may crash the kernel or execute arbitrary code with kernel privileges, compromising confidentiality, integrity, and availability of the affected system.

All systems running the Linux kernel that contain the vulnerable l2cap_sock_new_connection_cb() implementation. The exact kernel versions are not enumerated in the advisory, so any kernel build that has not yet applied the patch is potentially affected.

The CVSS score of 8.8 classifies this flaw as high severity. The EPSS score of <1% suggests a low estimated probability of exploitation in the wild, and it is not listed in the CISA KEV catalog. Nevertheless, the flaw can be triggered by establishing an L2CAP connection with a malicious Bluetooth device, so it is theoretically feasible without user interaction. The vulnerability would require operating at the host level, but once a Bluetooth attack vector is available, an attacker could leverage the use‑after‑free to gain unintended kernel execution.