The flaw is a use‑after‑free condition in the Bluetooth core of the Linux kernel. During device teardown, hci_unregister_dev() fails to stop the cmd_timer and ncmd_timer before freeing the hci_dev structure. If a timer expires while the structure is still referenced, the callback accesses freed memory, in particular the hdev->reset function pointer. This results in kernel memory corruption and can allow an attacker to execute arbitrary code in kernel mode.

The vulnerability is present in the generic hci_core code of the Linux kernel. It affects any Linux distribution that ships a kernel version before the commit that introduces disable_delayed_work_sync() calls. Therefore, all systems running an unpatched Linux kernel that supports Bluetooth hardware are potentially impacted.

The CVSS score of 7.8 places this flaw in the high‑severity range. The EPSS score of <1% indicates a low but nonzero likelihood of exploitation in the wild. Because it is not listed in the CISA KEV catalog, no known active exploits are reported. Nevertheless, the flaw resides in privileged kernel code; a local attacker with sufficient access could potentially trigger the use‑after‑free and gain kernel‑level execution. The overall risk remains moderate until the patch is applied.