This vulnerability stems from the Linux kernel’s handling of ISO packets received over Bluetooth. When a controller sends malformed ISO packets—specifically an ISO_START followed by an ISO_CONT that ends the payload—the kernel may leak a reference to the underlying skb, or even crash when an ISO_END packet is too long and causes an out‑of‑bounds write. The bug also accepts ISO_END packets that are shorter than required, bypassing expected checks. These flaws represent an improper validation of packet contents and a mutable pointer that can lead to kernel memory corruption, resulting in a system crash.

The flaw is present in the Linux kernel’s Bluetooth ISO implementation and potentially affects all distributions that ship the current kernel version without the patch. No product‑specific versions are provided in the CVE data, so any system running the affected kernel may be vulnerable.

The CVSS score is 8.8 and the EPSS indicates a very low but non‑zero exploitation probability (<1%). Because the flaw requires an adversary to send crafted Bluetooth ISO packets, the attack vector is likely local or restricted to devices that can establish a Bluetooth connection. The vulnerability is not listed in the CISA KEV catalog. If exploitation succeeds, it can cause a kernel panic or memory corruption, potentially allowing an attacker to gain elevated privileges or cause a denial of service.