The Linux kernel Bluetooth implementation performs lookups of connection parameters without holding the hdev->lock, creating an unsynchronized access to shared data. This race can lead to unsafe memory accesses and a kernel panic, effectively shutting down the system. The flaw is identified as CWE-414, Unsynchronized Access to a Shared Variable.

All Linux kernel builds containing the Bluetooth HCI code before the commit that added the lock protection are vulnerable. No explicit version range is documented; therefore any system running an unpatched kernel with the Bluetooth subsystem exposed is at risk.

The CVSS score of 8.8 denotes high severity, while the EPSS score of less than 1% indicates a very low likelihood of real‑world exploitation. The vulnerability is not listed in CISA’s KEV catalog. An attacker would need local or privileged access to the Bluetooth devices to trigger the race, making exploitation difficult in most environments. Nonetheless, a successful exploit would result in a kernel crash and denial of service.