The vulnerability occurs when the Bluetooth 6lowpan subsystem schedules a work item to set the 6L‑WPAN enable state asynchronously, while a module teardown can occur concurrently. The shutdown routine removes files from debugfs, closes the listening channel, and deallocates kernel objects without canceling the pending work. Consequently, the queued work later dereferences freed memory, producing a use‑after‑free scenario that could be leveraged to corrupt kernel data or execute arbitrary code. The primary weakness is a race condition that results in a use‑after‑free error, as confirmed by the KASAN stack trace. The likely attack vector is local and requires the attacker to trigger the debugfs write before the module unload, so root or privileged local access is inferred.

The issue affects the Linux kernel’s Bluetooth 6lowpan driver. Any kernel version that contains the unpatched bluetooth_6lowpan module is vulnerable; the fix was applied in later kernel commits (e.g., the commit referenced in the advisory). Specific affected releases are not listed, so any Linux kernel without the commit that schedules do_enable_set synchronously is susceptible.

The vulnerability’s CVSS score is 5.5, and the EPSS score is < 1%. The presence of a use‑after‑free race in a kernel module suggests a serious exploitability risk, especially for local privileged users. The issue is not listed in CISA KEV, indicating no publicly documented exploit yet, but the potential for kernel privilege escalation warrants prompt remediation.