A bug in the Linux kernel’s Bluetooth mgmt subsystem dereferences RCU‑protected hci_conn pointers outside safe critical sections, creating a use‑after‑free condition. Exploitation can corrupt kernel memory, crash the system, or allow arbitrary code execution for an attacker with the ability to send crafted Bluetooth commands.

All Linux distributions that use the stock kernel and enable the Bluetooth mgmt interface are potentially affected. No specific version range was supplied, but the issue correlates with recent commits that modify reference counting and locking for hci_conn in mgmt_pending_cmds.

The CVSS score is not provided and the EPSS score is missing, so the precise likelihood of exploitation is unclear. However, because the flaw operates in kernel space and can lead to memory corruption, the potential impact is severe. The vulnerability is not listed in CISA’s KEV catalog, which indicates it has not yet been observed as a widely exploited issue, but the lack of exploit data does not lower the risk of a local attacker.