The flaw exists in the Linux kernel Bluetooth hci_uart driver and is caused by the HCI_UART_SENDING flag, which marks a pending write work item. When the driver closes the device, it cancels the write work but fails to clear this flag. If the cancellation occurs while a write request is still outstanding, subsequent attempts to send data after reopening the device remain blocked because the flag is still set, effectively preventing any further Bluetooth HCI UART traffic. This race‑condition problem does not lead to code execution or data disclosure but disrupts normal Bluetooth functionality, resulting in a denial of service for applications that rely on the HCI UART interface.

Based on the description, it is inferred that all Linux kernel installations that have not incorporated the hci_uart patch are vulnerable. The problem appears in any kernel that includes the driver without the commit identified by 1b0d946d, regardless of distribution or minor version. Based on the description, it is inferred that software that ships with older kernels and still loads the hci_uart module may experience repeated write failures after device close events.

The CVSS score of 8 indicates a high‑impact vulnerability. The EPSS score of less than 1% implies that the likelihood of real‑world exploitation is currently low. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that exploitation would normally require an attacker to repeatedly open and close a Bluetooth HCI UART device while a write operation is pending, which is typically achievable by a local process with sufficient privileges to interact with the kernel driver. Because the flaw only causes a service interruption rather than privilege escalation or data exposure, the attack surface is limited to local or users able to control the Bluetooth subsystem.