The Linux kernel’s Bluetooth management code contains a missing reference count and inadequate locking for hci_conn pointers that are held in mgmt_pending_cmds. Dereferencing these RCU‑protected pointers outside safe critical sections leads to a use‑after‑free flaw. The flaw can corrupt kernel memory and, if an attacker can trigger the buggy code path, may allow arbitrary code execution with kernel privileges. The weakness is identified as CWE‑416.

All Linux systems running a stock kernel that exposes the Bluetooth management interface without the recent fix are affected. The patch that introduced proper reference counting and locking appears in recent kernel releases, but the exact version range is not specified; any kernel prior to those commits is potentially vulnerable.

The severity is reflected in a CVSS score of 7.8, indicating moderate to high impact. The EPSS score is below 1 %, implying exploitation probability is currently low, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector is local—an attacker who can send malicious management commands to the kernel (such as a privileged local user or compromised Bluetooth device) may trigger the UAF. The flaw operates in kernel space, but requires an objective to pass a malformed command to the Bluetooth subsystem.