In the Linux kernel Bluetooth stack, a bug in the adv‑monitor add path causes a use‑after‑free of the monitor structure. When the Microsoft‑offload (MSFT) command fails, the monitor remains registered in the IDR table while the memory is later freed. Subsequent code that reads the monitor handle or other fields then accesses already freed memory, creating a slab‑use‑after‑free. The vulnerability can lead to memory corruption, a kernel panic or, if an attacker can supply crafted input, execution of arbitrary code with kernel privileges.

All Linux kernel builds that include the Bluetooth stack are affected if they date from before the commit that added the cleanup changes. The fix is present in the upstream tree and any distribution kernel that has not yet incorporated the commit (e.g., 384a4b2f…) remains vulnerable. No specific downstream version range is listed, so any system running an older kernel that embeds the non‑fixed Bluetooth code is at risk.

The flaw resides entirely in kernel space and requires interaction with the Bluetooth subsystem. Based on the description it is inferred that an attacker would need to initiate MGMT commands against the device, which could be performed by a nearby Bluetooth device that can communicate over HCI. The CVSS score of 7.8 indicates high severity, while the EPSS score is less than 1%, suggesting a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog, but the nature of a use‑after‑free and its kernel‑level impact indicates that, if an attacker can reach it, local privilege escalation is possible. No public exploit has been reported at the time of this analysis, yet the potential for local kernel code execution warrants immediate attention.