In the Linux kernel Bluetooth subsystem, a race condition involves RCU‑protected pointers accessed outside their critical sections, resulting in a use‑after‑free of a connection structure. This flaw could allow an attacker to dereference freed memory, enabling execution of arbitrary code with kernel privileges or causing a kernel crash.

All Linux kernels that include the default Bluetooth driver carry the risk; specific affected releases are not enumerated in the available data and should be patched once the fix is released.

The CVE has a CVSS score of 8.8 and an EPSS score of less than 1%, indicating high severity but low likelihood of exploitation. It is not listed in CISA’s KEV catalog, and the vulnerability involves a use‑after‑free due to race conditions in the Bluetooth subsystem. Although no public exploitation has been documented, an attacker could trigger the race by interacting with the Bluetooth stack, potentially leading to kernel privilege escalation or a crash. The exploit would require precise timing and user‑space control of the Bluetooth connection to create the concurrency condition.