A use‑after‑free flaw in the Linux kernel Bluetooth hci_qca driver can lead to a kernel crash. When a controller reports a memory‑dump size of zero, the code frees an allocated structure but fails to reset the global pointer and related state flags, leaving subsequent work items with a stale reference to freed memory. If triggered repeatedly this can corrupt kernel data or cause an exception, resulting in a denial of service. The weakness is identified as CWE‑825.

Linux kernel builds that include the hci_qca driver and have not applied the recent patch are affected. The CNA lists the vendor as Linux and the product as Linux kernel, and no specific release numbers are supplied, so any distribution kernel hosting the unpatched driver should be considered at risk.

The CVSS score of 8.8 indicates high severity, and the EPSS score of <1% suggests a very low likelihood that an active exploit will be executed. It is not listed in the CISA KEV catalog, implying no known active exploitation. The attack vector is inferred from the description: it would likely be performed from a nearby Bluetooth device that can send a packet causing the controller to report a zero dump size. Successful exploitation would cause the kernel to crash and the system to become unavailable.