The bug occurs when a debugfs write operation for the Bluetooth 6lowpan module releases the HCI device lock before dereferencing an L2CAP connection that may have already been torn down by a disconnect or device close. This race condition results in a use‑after‑free of the L2CAP connection object. When the kernel accesses freed memory, it can crash, causing a denial of service, and if an attacker can influence the freed space, there is a theoretical potential for code execution.

The flaw is present in the Linux kernel’s Bluetooth 6lowpan implementation. Any Linux kernel distribution that has not applied the patch commit referenced in the advisory is vulnerable. The advisory lists the vendor as Linux: Linux, and no specific version ranges are provided, so all affected builds before the fix should be considered at risk.

The CVSS score is 5.5, while the EPSS score is less than 1%, and the vulnerability is not listed in the CISA KEV catalog. The vulnerability appears to be exploitable only when an attacker can write to the Bluetooth 6lowpan debugfs interface, which is usually restricted to privileged or root users. The race condition can be triggered by interleaving a debugfs write with a HCI disconnect or device close. While a local privilege escalation or kernel crash can be achieved, the exploitation requires local access and the presence of the Bluetooth 6lowpan module.