The flaw exists in the Linux kernel Bluetooth hci_uart driver and is caused by the HCI_UART_SENDING flag, which marks a pending write work item. When the driver closes the device, it cancels the write work but fails to clear this flag, exposing both CWE‑413 and CWE‑667 weaknesses. If the cancellation occurs while a write request is still outstanding, subsequent attempts to send data after reopening the device remain blocked because the flag is still set, effectively preventing any further Bluetooth HCI UART traffic. This race‑condition problem does not lead to code execution or data disclosure but disrupts normal Bluetooth functionality, resulting in a denial of service for applications that rely on the HCI UART interface.

All Linux kernel installations that include the hci_uart driver without the commit 1b0d946d are affected; this includes any distribution or minor version that has not applied the kernel patch.

The CVSS score of 8 indicates a high‑impact vulnerability. The EPSS score of < 1% implies that the likelihood of real‑world exploitation is currently low. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that exploitation would normally require a local process that can open and close a Bluetooth HCI UART device while a write operation is pending. This typically requires sufficient privileges to interact with the kernel driver. Because the flaw only causes a service interruption rather than privilege escalation or data exposure, the attack surface is limited to local or privileged users controlling the Bluetooth subsystem.