The kernel contains a race condition in the Bluetooth RFCOMM TTY driver that can result in a use‑after‑free when an ioctl to set terminal parameters is invoked concurrently with a Bluetooth device removal. The freed session data is later accessed, causing a kernel memory corruption that can be leveraged by a local attacker to execute arbitrary code or crash the system. The root cause is a missing lock around the session pointer during the RPN request, leading to a heap use‑after‑free (CWE‑122).

All Linux kernel builds that include the buggy RFCOMM code before the patch are affected. The specific versions are not listed, so users should treat all kernels older than the update that contains the fix as vulnerable.

The CVSS score is not provided and EPSS is unavailable, but the vulnerability is a kernel use‑after‑free that can be triggered via standard Bluetooth interfaces when a device is removed during a TTY ioctl. It is not listed in the CISA KEV catalog, suggesting no known active exploits yet, but the local nature of the attack and potential for privilege escalation make it a high‑risk issue. An attacker with local access to the machine and control over a Bluetooth peripheral could trigger the race, potentially gaining kernel‑level execution or causing a denial of service.