The flaw arises from a race condition between the Bluetooth HCI command workqueue and management socket operations that modify the device’s UUID list. When the workqueue holds the hdev->req_lock but does not hold hdev->lock, a UUID entry can be freed by add_uuid()/remove_uuid() while another thread concurrently reads it during EIR snapshot creation. This leads to a use‑after‑free that corrupts kernel memory, as documented by KASAN. The vulnerability is a classic race‑condition (CWE‑362) that escalates to a use‑after‑free (CWE‑825), which can cause kernel panics and denial of service.

All Linux kernel releases that exclude the commit a351f68fb (or later merges) which introduced proper lock ordering for UUID list access. Distribution kernels that have not incorporated this patch remain vulnerable. Default configurations in upstream Linux kernels prior to the patch include the flaw.

The CVSS score of 7.8 reflects the potential for kernel crashes. The EPSS score of < 1% indicates a very low likelihood of public exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need local or Bluetooth‑based access to manipulate UUID entries via Bluetooth commands or a management socket in order to trigger the race condition. Once the race is executed, the kernel can crash, resulting in denial of service. Remote exploitation without such local or Bluetooth connectivity is not supported by the current data.