The vulnerability occurs in the Linux kernel Bluetooth driver for Qualcomm QCA controllers when the controller reports a zero memory dump size. The code path frees a local memory dump object but fails to clear the global pointer and associated flags. A subsequent work item then reuses the stale pointer to freed memory, resulting in a use‑after‑free condition that can corrupt kernel memory or cause a crash, effectively denying service. This flaw is a classic example of CWE‑416: Use After Free.

All Linux kernel releases that include the hci_qca driver and have not yet applied the patch are affected. The vulnerability is present in any system that employs the generic Linux kernel Bluetooth stack with a Qualcomm QCA controller. No specific version numbers were supplied, so any install that runs an unpatched kernel should be considered vulnerable.

The CVSS and EPSS metrics are not available and the vulnerability is not listed in the CISA KEV catalog, so a precise quantitative risk is unknown. The likely attack vector is a malicious Bluetooth packet sent to a QCA controller, which may be from a local or remote device if Bluetooth is enabled. An attacker can trigger the flaw by causing the controller to return a zero dump size during a memory dump request, which may crash the kernel and bring the system down. While no active exploits have been reported, the nature of the bug suggests that exploitation could lead to a denial of service and, depending on the kernel context, potentially provide an avenue for privilege escalation.