In the Linux kernel Bluetooth stack there is a use‑after‑free flaw triggered during a connection‑parameter update request. The queued work handler retains a borrowed pointer to a connection‑parameter structure that may be freed by a subsequent request. When the stale pointer is dereferenced, a kernel memory corruption occurs that could be exploited to execute arbitrary code or crash the system. This code flaw is a classic use‑after‑free scenario combined with improper synchronization of shared data (CWE‑825).

All Linux kernel builds that incorporate the Bluetooth subsystem before the fix in commit 2bf282f8f715f5d05d6f4c49ffb3bd241c5e667e are affected. No explicit version list is supplied, so any kernel older than the referenced patch is vulnerable.

An attacker can trigger the vulnerability by sending a crafted LOAD_CONN_PARAM request to the local Bluetooth controller. The exploit requires local or privileged access to the device and a functioning Bluetooth stack. The EPSS score is < 1 % and the vulnerability is not listed in CISA KEV, indicating no publicly known exploits to date. The CVSS score of 7.8 indicates high severity. The use‑after‑free flaw still enables potential privilege escalation or denial of service if successfully exploited.